An industrial terminal trust evaluation method, device, equipment, medium and program product

Abstract

The application provides an industrial terminal trust evaluation method and device, equipment, medium and program product, relates to the technical field of safety, and is used for improving the refinement and reliability of the trusted management of the industrial terminal in the industrial control environment. The specific technical scheme is as follows: based on the interaction related data of at least two industrial terminals within a predetermined time period, interaction feature information of the at least two industrial terminals is obtained; based on the interaction feature information of the at least two industrial terminals, a dynamic trust graph is constructed, and the dynamic trust graph is used to represent the control link and the risk propagation path between the at least two industrial terminals within the predetermined time period; based on the dynamic trust graph, the trust degree of each industrial terminal is evaluated, and the trust state information of each industrial terminal is output. The application is applied to the risk control scene of the industrial terminal in the industrial control environment.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to an industrial terminal trust assessment method, apparatus, equipment, medium, and program product. Background Technology

[0002] With the development of the Industrial Internet, the Industrial Internet of Things and new-generation information technology, traditional industrial control systems characterized by closed operation and physical isolation are gradually evolving into complex systems with multiple levels, multiple regions and cross-network interconnection. Field sensors, actuators, programmable logic controllers, engineering workstations and various operation and maintenance industrial terminals are continuously connected to the industrial control network on a massive scale.

[0003] In related technologies, the credibility score or anomaly determination of industrial terminals can be performed by analyzing the network traffic characteristics, operation frequency, or abnormal event records of industrial terminals.

[0004] Therefore, in implementing the above scheme, the relatively singular evaluation dimensions result in low accuracy of the final credibility score or anomaly detection results, making it difficult to comprehensively depict the true credibility status of industrial terminals in complex industrial control scenarios. Summary of the Invention

[0005] This application provides an industrial terminal trust assessment method, apparatus, equipment, medium, and program product to improve the precision and reliability of industrial terminal trust management in industrial control environments.

[0006] In a first aspect, embodiments of this application provide an industrial terminal trust assessment method, which includes: obtaining interaction feature information of at least two industrial terminals based on interaction-related data of at least two industrial terminals within a predetermined time period, wherein the interaction feature information of each industrial terminal includes the identity information of the industrial terminal, the interaction behavior information of the industrial terminal, the access context information of the industrial terminal, and the environmental situation information of the trust environment in which the industrial terminal is currently located; constructing a dynamic trust graph based on the interaction feature information of the at least two industrial terminals, wherein the dynamic trust graph is used to characterize the control link and risk propagation path between the at least two industrial terminals within the predetermined time period; and assessing the trustworthiness of each industrial terminal based on the dynamic trust graph, and outputting the trust status information of each industrial terminal.

[0007] The technical solution provided in this application brings at least the following beneficial effects: This application models the industrial control terminal and the interaction relationship between industrial terminals as a dynamic trust graph, and introduces trust scoring and uncertainty into access control and event classification decision-making, thereby realizing a risk-adaptive security strategy in the industrial control system and improving the refinement and reliability of trusted management of industrial terminals in the industrial control environment.

[0008] One possible implementation is that the predetermined time period includes at least one time slice, the dynamic trust graph includes at least one dynamic trust graph, and one dynamic trust graph corresponds to one time slice within the predetermined time period; the dynamic trust graph includes industrial terminal nodes corresponding to the at least two industrial terminals and at least one directed edge, each directed edge is labeled, each directed edge connects the industrial terminals corresponding to the industrial terminal nodes and there is interaction behavior between them, the direction of each directed edge is used to characterize the behavior direction in the execution interaction behavior between the industrial terminals corresponding to the directed edge, and the edge label of a directed edge is used to indicate the trust index of the interaction behavior between the industrial terminals corresponding to the directed edge, the trust index including trust tendency or trust risk.

[0009] Another possible implementation involves constructing a dynamic trust graph based on the interaction feature information of the at least two industrial terminals. This includes: establishing directed edges between the industrial terminal nodes corresponding to the industrial terminals that have interactive behavior within the first time slice, based on the interaction feature information of the at least two industrial terminals within the first time slice; adding edge labels to each directed edge according to the security device alarms, access control policy matching results, and manual audit conclusions associated with each directed edge, thereby constructing a dynamic trust graph corresponding to the first time slice; wherein the first time slice is one of the at least one time slice.

[0010] Another possible implementation involves evaluating the trustworthiness of each industrial terminal based on the aforementioned dynamic trust graph and outputting the trust status information of each industrial terminal. This includes: determining the structural embedding vector corresponding to the first industrial terminal in each time slice based on each dynamic trust graph; wherein a structural embedding vector is used to characterize the trust index of the interaction behavior of the first industrial terminal in a time slice and the similarity between it and the trust index of the interaction behavior of the industrial terminals corresponding to the neighboring industrial terminal nodes in the dynamic trust graph corresponding to the first industrial terminal in the aforementioned time slice; the aforementioned first industrial terminal nodes correspond to the aforementioned first industrial terminals; constructing the time encoding vector corresponding to the first industrial terminal based on the structural embedding vector corresponding to the first industrial terminal in each time slice according to the temporal order of the time slices; obtaining the trust status information of the first industrial terminal based on the time encoding vector corresponding to the first industrial terminal; wherein the aforementioned first industrial terminal is one of the aforementioned at least two industrial terminals.

[0011] Another possible implementation, based on each dynamic trust graph, determines the structural embedding vector corresponding to the first industrial terminal in each time slice, including: obtaining the initial Gaussian embedding vector of each industrial terminal node in the first dynamic trust graph corresponding to the first time slice, wherein the first dynamic trust graph is one of the at least one dynamic trust graphs; based on the initial Gaussian embedding vector of each directed edge connecting the industrial terminal nodes in the first dynamic trust graph, mapping the edge label of each directed edge to a first Gaussian embedding vector, thereby obtaining the first Gaussian embedding vector of each directed edge; the first Gaussian embedding vector of a directed edge is used to characterize the trust index of the interaction behavior between the two industrial terminals corresponding to the directed edge; based on the first Gaussian embedding vector of the directed edge where the first industrial terminal node is located, and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located in the first dynamic trust graph, calculating the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edges where the other industrial terminal nodes are located in the first dynamic trust graph; and based on the Gaussian embedding similarity, obtaining the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice.

[0012] Another possible implementation is that the Gaussian embedding similarity includes cosine similarity and Jaccard similarity; the process of obtaining the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice based on the Gaussian embedding similarity includes: calculating a weighted sum of squares on the cosine similarity and the Jaccard similarity to obtain the confidence of the directed edge where the first industrial terminal node is located; normalizing the confidence of the directed edge where the first industrial terminal node is located to obtain a defense coefficient, which is used to constrain the degree of deviation in message transmission between the first industrial terminal and the industrial terminals corresponding to the neighboring industrial terminal nodes; and calculating the structural embedding vector of the first industrial terminal in the first time slice based on the defense coefficient and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located.

[0013] Another possible implementation is that, after assessing the trustworthiness of each industrial terminal based on the aforementioned dynamic trust graph and outputting the trust status information of each industrial terminal, the method further includes: generating a target security policy based on the trust status information of each industrial terminal; and sending corresponding security operation instructions to all or some of the industrial terminals among the at least two industrial terminals based on the target security policy.

[0014] Secondly, embodiments of this application provide an industrial terminal trust assessment device, comprising: an acquisition module, a construction module, and a processing module; the acquisition module is used to acquire interaction feature information of at least two industrial terminals based on interaction-related data of at least two industrial terminals within a predetermined time period, wherein the interaction feature information of each industrial terminal includes the industrial terminal's identity information, the industrial terminal's interaction behavior information, the industrial terminal's access context information, and the environmental situation information of the trust environment in which the industrial terminal is currently located; the construction module is used to construct a dynamic trust graph based on the interaction feature information of the at least two industrial terminals, wherein the dynamic trust graph is used to characterize the control link and risk propagation path between the at least two industrial terminals within the predetermined time period; the processing module is used to assess the trustworthiness of each industrial terminal based on the dynamic trust graph and output the trust status information of each industrial terminal.

[0015] The technical solution provided in this application brings at least the following beneficial effects: This application models the industrial control terminal and the interaction relationship between industrial terminals as a dynamic trust graph, and introduces trust scoring and uncertainty into access control and event classification decision-making, thereby realizing a risk-adaptive security strategy in the industrial control system and improving the refinement and reliability of trusted management of industrial terminals in the industrial control environment.

[0016] One possible implementation is that the predetermined time period includes at least one time slice, the dynamic trust graph includes at least one dynamic trust graph, and one dynamic trust graph corresponds to one time slice within the predetermined time period; the dynamic trust graph includes industrial terminal nodes corresponding to the at least two industrial terminals and at least one directed edge, each directed edge is labeled, each directed edge connects the industrial terminals corresponding to the industrial terminal nodes and there is interaction behavior between them, the direction of each directed edge is used to characterize the behavior direction in the execution interaction behavior between the industrial terminals corresponding to the directed edge, and the edge label of a directed edge is used to indicate the trust index of the interaction behavior between the industrial terminals corresponding to the directed edge, the trust index including trust tendency or trust risk.

[0017] Another possible implementation, the aforementioned construction module is specifically used to: establish directed edges between industrial terminal nodes corresponding to industrial terminals that have interactive behavior within the first time slice, based on the interaction feature information of the at least two industrial terminals within the first time slice; add edge labels to each directed edge according to the security device alarms, access control policy matching results, and manual audit conclusions associated with each directed edge, and construct a dynamic trust graph corresponding to the first time slice; wherein the first time slice is one of the at least one time slice.

[0018] Another possible implementation, the aforementioned processing module is specifically used for: determining the structure embedding vector corresponding to the first industrial terminal in each time slice based on each dynamic trust graph; wherein, a structure embedding vector is used to characterize the trust index of the interaction behavior of the first industrial terminal in a time slice, and the similarity between the trust index of the interaction behavior of the first industrial terminal node and the industrial terminal corresponding to the neighboring industrial terminal node in the dynamic trust graph corresponding to the time slice; the first industrial terminal node corresponds to the first industrial terminal; constructing the time encoding vector corresponding to the first industrial terminal based on the structure embedding vector corresponding to the first industrial terminal in each time slice according to the temporal order of the time slices; obtaining the trust state information of the first industrial terminal based on the time encoding vector corresponding to the first industrial terminal; wherein, the first industrial terminal is one of the at least two industrial terminals.

[0019] Another possible implementation, the aforementioned processing module is specifically used for: obtaining the initial Gaussian embedding vector of each industrial terminal node in the first dynamic trust graph corresponding to the first time slice, wherein the first dynamic trust graph is one of the at least one dynamic trust graphs; based on the initial Gaussian embedding vector of each directed edge connecting the industrial terminal nodes in the first dynamic trust graph, mapping the edge label of each directed edge to a first Gaussian embedding vector, thereby obtaining the first Gaussian embedding vector of each directed edge; the first Gaussian embedding vector of a directed edge is used to characterize the trust index of the interaction behavior between the two industrial terminals corresponding to the directed edge; based on the first Gaussian embedding vector of the directed edge where the first industrial terminal node is located, and the Gaussian embedding vector of the directed edges where the neighboring industrial terminal nodes of the first industrial terminal node are located in the first dynamic trust graph, calculating the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edges where the other industrial terminal nodes are located; and based on the Gaussian embedding similarity, obtaining the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice.

[0020] Another possible implementation is that the Gaussian embedding similarity includes cosine similarity and Jaccard similarity. Specifically, the processing module is used to: calculate a weighted sum of squares on the cosine similarity and the Jaccard similarity to obtain the confidence of the directed edge containing the first industrial terminal node; normalize the confidence of the directed edge containing the first industrial terminal node to obtain a defense coefficient, which is used to constrain the deviation in message transmission between the first industrial terminal and the corresponding industrial terminals of the neighboring industrial terminal nodes; and calculate the structural embedding vector of the first industrial terminal on the first time slice based on the defense coefficient and the Gaussian embedding vector of the directed edge containing the first industrial terminal node.

[0021] In another possible implementation, the above-mentioned device further includes: a sending module; the processing module is further configured to evaluate the trustworthiness of each industrial terminal based on the above-mentioned dynamic trust graph, output the trust status information of each industrial terminal, and then generate a target security policy based on the trust status information of each industrial terminal; the sending module is configured to send corresponding security operation instructions to all or some of the industrial terminals among the above-mentioned at least two industrial terminals based on the above-mentioned target security policy.

[0022] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0023] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0024] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0025] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0026] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0027] Figure 1 A schematic diagram of the network architecture for an industrial terminal trust assessment method provided in this application embodiment;

[0028] Figure 2 A flowchart illustrating an industrial terminal trust assessment method provided in this application embodiment;

[0029] Figure 3 A flowchart illustrating another industrial terminal trust assessment method provided in this application embodiment;

[0030] Figure 4 A flowchart illustrating another industrial terminal trust assessment method provided in this application embodiment;

[0031] Figure 5 A flowchart illustrating another industrial terminal trust assessment method provided in this application embodiment;

[0032] Figure 6 A flowchart illustrating another industrial terminal trust assessment method provided in this application embodiment;

[0033] Figure 7 This is a schematic diagram of the structure of a trust assessment system provided in an embodiment of this application;

[0034] Figure 8 A schematic diagram illustrating the module implementation process of an industrial terminal trust assessment method provided in this application embodiment;

[0035] Figure 9 A schematic diagram of the structure of an industrial terminal trust assessment device provided in this application embodiment;

[0036] Figure 10 A schematic diagram of the structure of an industrial terminal trust assessment device provided in this application embodiment;

[0037] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0039] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0040] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0041] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0042] This application provides an industrial terminal trust assessment method, apparatus, equipment, medium, and program product, which can be applied to risk control scenarios for industrial terminals in industrial control environments. Examples include power industry industrial control systems, petrochemical industry industrial control systems, intelligent manufacturing industrial plant scenarios, urban critical infrastructure industrial control systems, or industrial control system security management scenarios under a zero-trust architecture.

[0043] Industrial control systems are core support systems for critical infrastructures such as energy, power, petrochemicals, and intelligent manufacturing. Their security directly affects production continuity, equipment safety, and the safety of personnel and the environment. With the development of the Industrial Internet, the Industrial Internet of Things, and next-generation information technologies, traditional industrial control systems characterized by closed operation and physical isolation have gradually evolved into complex systems with multi-level, multi-regional, and cross-network interconnection. Field sensors, actuators, programmable logic controllers, engineering workstations, and various maintenance industrial terminals are continuously connected to industrial control networks on a massive scale. Against this backdrop, how to achieve secure access and operational control of industrial control terminals while ensuring production continuity has become one of the core issues in the field of industrial control security.

[0044] Trust assessment is a crucial step in secure access control for industrial control systems (ICS). Its core objective is to quantify the trustworthiness of industrial terminals within specific times and operating environments, providing a basis for security strategy formulation, risk management, and operational decisions. Compared to traditional information systems, ICS terminals are characterized by diverse types, long operating cycles, and strong dependence on technological processes. Their trust status is not only related to identity attributes but also closely linked to historical behavior, real-time operational context, and external security posture. Therefore, trust assessment in ICS scenarios requires the integration of multi-source, multi-dimensional information and the ability to adapt to dynamic changes in industrial terminal behavior and environmental conditions.

[0045] Currently, the main technologies related to trust assessment of industrial control terminals include the following three types of solutions:

[0046] 1) Trust determination based on static attributes or one-time authentication results: This type of technology typically judges the trustworthiness of an industrial terminal based on its identity, certificate validity, or device registration information. While simple to implement, the trust assessment results remain unchanged long after authentication, failing to reflect potential behavioral anomalies, configuration changes, or state changes after attacks during operation. This makes it difficult to meet the continuous trust assessment requirements of industrial control systems.

[0047] 2) Trust assessment based on single or limited behavioral characteristics: Some technologies analyze the network traffic characteristics, operation frequency, or abnormal event records of industrial terminals to score their trustworthiness or determine anomalies. While this approach introduces dynamic behavioral information to some extent, the assessment dimensions are relatively singular, making it difficult to comprehensively depict the true trustworthiness of industrial terminals in complex industrial control scenarios. Furthermore, different characteristics are typically fused using fixed weights or simple rules, lacking adaptability to changes in the security situation.

[0048] 3) Trust assessment models based on multi-factor fusion: This type of technology attempts to incorporate multiple factors, such as industrial terminal identity information, historical behavior, access context, and environmental security posture, into a unified assessment framework, outputting a trust score for the industrial terminal through statistical analysis or machine learning methods. Although this approach expands the assessment dimensions, its trust assessment results are usually expressed in deterministic numerical form, failing to reflect the reliability of the assessment conclusion itself. In industrial control environments, due to incomplete data collection and potential conflicts between multiple sources of evidence, a single deterministic score is insufficient to distinguish between "sufficiently proven credibility" and "insufficiently proven but no anomalies have been found," posing potential security risks.

[0049] Furthermore, current technologies treat trust assessment as an adjunct to access control or security decisions. In recent years, the zero-trust security concept has been gradually applied to industrial scenarios, with related solutions emphasizing dynamic adjustment of industrial terminal permissions based on continuous assessment results. However, existing solutions mostly focus on the access control policies themselves, with trust assessment mechanisms often embedded as black-box components. This lacks systematic modeling and evolutionary analysis of the trust state of industrial terminals, making it difficult to support refined management of industrial terminal trustworthiness in complex industrial control environments.

[0050] In summary, based on existing technologies related to trust assessment of industrial control terminals, the following shortcomings can be identified in practical applications:

[0051] 1) Trust assessment results are primarily deterministic, lacking characterization of the reliability of the assessment results. Most existing industrial terminal trust assessment methods represent the trustworthiness of industrial terminals as a single deterministic score or level, assuming that the assessment result itself is reliable. However, in industrial control scenarios, trust assessments are often based on incomplete, noisy, or conflicting multi-source data. A single deterministic result is difficult to reflect the uncertainty of the assessment conclusion and is prone to misjudgment in cases of insufficient evidence or conflicting information.

[0052] 2) The multi-factor trust information fusion method is static and lacks adaptability. Existing multi-factor trust assessment models usually use fixed weights or predefined rules to fuse identity information, behavioral characteristics and environmental factors. It is difficult to dynamically adjust the importance of various factors according to changes in the operating status of industrial terminals, process stage switching or changes in the overall security situation, resulting in insufficient adaptability of the assessment results to complex industrial control environments.

[0053] 3) Trust assessment is based on discrete time units, lacking a characterization of the trust state evolution process. Existing technologies mostly conduct trust assessments on industrial terminals at a single point in time or within an independent time window. The assessment results lack continuous correlation and are difficult to reflect the trend characteristics of the trust status of industrial terminals changing over time, and cannot effectively distinguish between occasional anomalies and persistent risks.

[0054] 4) Insufficient coupling between trust assessment and industrial control system operation scenarios makes it difficult to support the needs of refined security management. Some existing solutions treat trust assessment as an auxiliary function of access control or security decision-making. Their assessment process lacks systematic modeling of the differences in industrial control terminal types, operating cycles, and process dependencies, making it difficult to meet the needs of refined and long-term management of industrial terminal trustworthiness in complex industrial control scenarios.

[0055] To address this, this application provides a method and system for trust assessment of industrial control terminals, capable of characterizing the reliability of trust assessment results, namely the industrial terminal trust assessment method described in the following embodiments of this application. By introducing the expression of uncertainty in the assessment results during the trust assessment process, the assessment results not only reflect the trustworthiness of the industrial terminal but also the credibility level of the assessment conclusion itself, thereby reducing the risk of misjudgment in cases of insufficient evidence or conflicting information.

[0056] On the one hand, it achieves adaptive evaluation capabilities for multi-factor trust information. This enables multi-dimensional factors such as the identity information, historical behavior, access context, and environmental security status of industrial terminals to be dynamically adjusted according to changes in the status of industrial terminals and the overall operating environment during the trust evaluation process, thereby improving the adaptability of trust evaluation to complex industrial control scenarios.

[0057] On the other hand, it also supports the continuous assessment and evolution of the trust status of industrial control terminals. By continuously assessing the trust status of industrial terminals over time, it reflects the changing trend of the trustworthiness of industrial terminals, providing a basis for distinguishing between short-term anomalies and long-term risks.

[0058] Furthermore, it provides a more reliable foundation for trust assessment in industrial control systems, enhancing the accuracy, stability, and interpretability of trust assessment results to provide credible support for subsequent safety management and operational decisions.

[0059] In summary, this application aims to propose a trust assessment technology for industrial control scenarios. By systematically modeling multi-factor trust evidence, it introduces the perception and quantification of assessment uncertainty and supports the continuous updating and evolution of the trust status of industrial terminals, thereby providing a more reliable trust assessment basis for security management and risk control in industrial control systems.

[0060] The following description, in conjunction with the accompanying drawings, details the industrial terminal trust assessment method, apparatus, equipment, media, and program products provided in the embodiments of this application.

[0061] Figure 1 This paper illustrates the network architecture of an industrial terminal trust assessment method provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture includes an industrial terminal trust assessment device 101 and an industrial terminal device 102. The industrial terminal trust assessment device 101 and the industrial terminal device 102 are interconnected.

[0062] In some embodiments, the industrial terminal trust assessment device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster comprising multiple servers. It should be noted that the embodiments of this application do not limit the specific device form of the industrial terminal trust assessment device 101. Figure 1 The example shown is an industrial terminal trust assessment device 101 with a single server.

[0063] In some embodiments, industrial terminal equipment may be mobile phones, tablets, laptops, handheld computers, in-vehicle electronic devices, mobile internet devices (MID), augmented reality (AR) / virtual reality (VR) devices, robots, wearable devices, personal computers (PCs), ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., and the embodiments of this application do not impose specific limitations. Figure 1 The example shown is an industrial terminal device 102, which is a mobile phone.

[0064] In some embodiments, the industrial terminal trust assessment device 101 obtains interaction feature information of at least two industrial terminal devices 102 based on interaction-related data of at least two industrial terminal devices 102 within a predetermined time period. The interaction feature information of each industrial terminal device 102 includes its identity information, interaction behavior information, access context information, and environmental situation information of its current trust environment. Based on the interaction feature information of the at least two industrial terminal devices 102, a dynamic trust graph is constructed. This dynamic trust graph characterizes the control link and risk propagation path between the at least two industrial terminal devices 102 within the predetermined time period. Based on the dynamic trust graph, the trustworthiness of each industrial terminal device 102 is assessed, and the trust status information of each industrial terminal device 102 is output. Based on the trust status information of each industrial terminal device 102, the industrial terminal trust assessment device 101 generates a target security policy and then, based on the target security policy, sends corresponding security operation instructions to all or some of the at least two industrial terminal devices 102. The industrial terminal equipment 102 executes the corresponding safety operation according to the received safety operation instructions.

[0065] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0066] See Figure 2 This is a flowchart illustrating an industrial terminal trust assessment method provided in an embodiment of this application. Figure 2 As shown, the industrial terminal trust assessment method provided in this application embodiment can be implemented by the above-mentioned industrial terminal trust assessment device, specifically including the following steps 201 to 203.

[0067] Step 201: The industrial terminal trust assessment device obtains the interaction characteristic information of at least two industrial terminals based on the interaction-related data of at least two industrial terminals within a predetermined time period.

[0068] In some embodiments, the interaction feature information of each industrial terminal includes the industrial terminal's identity information, the industrial terminal's interaction behavior information, the industrial terminal's access context information, and the environmental situation information of the trust environment in which the industrial terminal is currently located.

[0069] For example, the aforementioned interactive feature information includes at least: the identity and asset information of the industrial control terminal, network and industrial control protocol interaction data, host and security event information, and environment and operating context information.

[0070] For example, the identity information of the aforementioned industrial terminals is used to identify the industrial terminal identities of different industrial terminals.

[0071] For example, the access context information of the aforementioned industrial terminal is the context information for mutual access between industrial terminals.

[0072] For example, the environmental situation information of the trust environment in which the industrial terminal is currently located includes various security event information, environmental information, and operational information.

[0073] Step 202: The industrial terminal trust assessment device constructs a dynamic trust graph based on the interaction feature information of at least two industrial terminals.

[0074] In some embodiments, the dynamic trust graph described above is used to characterize the control links and risk propagation paths between at least two industrial terminals within a predetermined time period.

[0075] For example, the control link described above can characterize the attribute information of industrial terminals, the interaction relationships between industrial terminals, and the temporal changes in these interaction relationships. For instance, the temporal sequence of operational information such as control commands, status reads, or file program transfers.

[0076] In some embodiments, the predetermined time period includes at least one time slice.

[0077] In some embodiments, the industrial terminal trust assessment device divides the predetermined time period into slices according to a preset time interval to obtain at least one time slice.

[0078] In some embodiments, the aforementioned predetermined time period and preset time interval can be system default settings or user-defined settings.

[0079] In some embodiments, the dynamic trust graph described above includes at least one dynamic trust graph.

[0080] In some embodiments, a dynamic trust graph corresponds to a time slice within a predetermined time period.

[0081] For example, the aforementioned dynamic trust graph can be a sequence of dynamic trust graphs, in which each dynamic trust graph is arranged according to the temporal order of its corresponding time slice.

[0082] In some embodiments, the dynamic trust graph described above includes industrial terminal nodes corresponding to at least two industrial terminals and at least one directed edge.

[0083] In some embodiments, each directed edge connects the industrial terminals corresponding to the industrial terminal nodes, and there is interaction behavior between them.

[0084] For example, the above-mentioned interactive behaviors include at least: communication, control, operation and maintenance, or dependency behaviors.

[0085] In some embodiments, the direction of each directed edge is used to characterize the behavior direction in the execution interaction behavior between the industrial terminals corresponding to the directed edge.

[0086] For example, the direction of each directed edge is used to represent the direction of control commands, access requests, data transmission, operation and maintenance operations or dependencies in the corresponding interaction behavior.

[0087] For example, taking industrial terminal A as the operation and maintenance management server and industrial terminal B as the field industrial control and data acquisition industrial terminal, the management server issues start / stop commands and parameter configuration commands to control the operation of the data acquisition industrial terminal. At this time, the two form a control relationship, and the directed edge points from industrial terminal A to industrial terminal B.

[0088] For example, if we take industrial terminal A as the business application industrial terminal and industrial terminal B as the database storage industrial terminal, the application industrial terminal must access the data resources of the database to run its business and cannot work independently without the database. At this time, the two form a dependency relationship, and the directed edge points from industrial terminal A to industrial terminal B.

[0089] For example, taking industrial terminal A as a business client and industrial terminal B as a business gateway industrial terminal as an example, the two routinely send and receive business messages and exchange business data. At this time, the two form a peer-to-peer communication behavior, and the directed edge is bidirectional, pointing to industrial terminal A and industrial terminal B respectively.

[0090] For example, if industrial terminal A is the operation and maintenance management industrial terminal and industrial terminal B is the business operation industrial terminal, the operation and maintenance industrial terminal can remotely perform operations such as login inspection, patch distribution, and fault debugging on the business operation industrial terminal. At this time, the two form an operation and maintenance relationship, and the directed edge points from industrial terminal A to industrial terminal B.

[0091] In some embodiments, each directed edge is provided with an edge label, and the edge label of a directed edge is used to indicate the trust index of the interaction behavior between the industrial terminals corresponding to the directed edge.

[0092] In some embodiments, the aforementioned trust indicators include trust tendency or trust risk.

[0093] In some embodiments, the industrial terminal trust assessment device abstracts each industrial terminal as a node in a dynamic trust graph, and abstracts the communication, control, operation and maintenance, or dependency relationships between industrial terminals as directed edges. The system uses a time-slicing mechanism to divide the continuous operation process into a series of time slices, thereby constructing a dynamic graph sequence that evolves over time. This dynamic trust graph not only preserves the individual state information of the industrial terminals but also explicitly expresses the control links and risk propagation paths between them, enabling trust assessment to be conducted within a unified framework of "industrial terminal—relationship—time," rather than evaluating individual industrial terminals in isolation.

[0094] In one example, by analyzing continuous time intervals That is, the aforementioned predetermined time period, at fixed time intervals. By slicing the data into slices, multiple time slices are obtained. Based on the industrial terminal behavior and interaction characteristics information in these time slices, a series of time-ordered dynamic trust graphs can be obtained. Each dynamic trust graph snapshot Corresponding to a time slice, This is the collection of active industrial terminals during this time slice. This is the set of trust / risk interaction edges between industrial terminals observed within a time slice.

[0095] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, step 202 can be implemented through steps 202a and 202b.

[0096] Step 202a: The industrial terminal trust assessment device establishes directed edges between industrial terminal nodes corresponding to industrial terminals that have interactive behavior within the first time slice, based on the interaction feature information of at least two industrial terminals within the first time slice.

[0097] In some embodiments, the first time slice is one of at least one time slice.

[0098] Step 202b: The industrial terminal trust assessment device adds edge labels to each directed edge based on the security device alarms, access control policy matching results, and manual audit conclusions associated with each directed edge, and constructs a dynamic trust graph corresponding to the first time slice.

[0099] In some embodiments, the aforementioned side label can be a risk label or a trust label, denoted as... .

[0100] In one example, This indicates that the interaction behavior is considered normal and trustworthy. This indicates that the interaction has significant abnormal characteristics or has been judged as malicious behavior.

[0101] For example, if the corresponding link has alarms on all devices, abnormal access control policy matching, or is judged to be in violation by manual audit, the directed edge is labeled with a risk label; if the corresponding link has no alarms on devices, the access control policy matching is compliant, or the manual audit verification is normal, the directed edge is labeled with a trust label; if the corresponding link has sporadic alarms and the policy matching is compliant, but there are doubts in the manual audit, the directed edge is labeled with a pending review label; if the corresponding link has a large number of alarms and the policy does not match, but the manual audit excludes illegal behavior, the directed edge is labeled with a special allow label.

[0102] In this way, the trustworthiness of interactions between industrial terminals can be obtained through edge tags, providing structured input for subsequent trust propagation, aggregation, and time evolution modeling, thereby improving the expressive power and robustness of trust assessment in complex industrial control environments.

[0103] Step 203: The industrial terminal trust assessment device evaluates the trustworthiness of each industrial terminal based on the dynamic trust graph and outputs the trust status information of each industrial terminal.

[0104] In some embodiments, the trust state information described above is used to generate a target security policy.

[0105] In some embodiments, the aforementioned trust status information is the trust assessment result for each industrial terminal.

[0106] For example, the aforementioned trust status information can be a comprehensive trust assessment score, which is used to characterize the trustworthiness and uncertainty of industrial terminals.

[0107] In some embodiments, combined with Figure 2 like Figure 4 As shown, step 203 can be implemented through steps 203a to 203c.

[0108] Step 203a: The industrial terminal trust assessment device determines the structure embedding vector corresponding to the first industrial terminal in each time slice based on each dynamic trust graph.

[0109] In some embodiments, a structural embedding vector is used to characterize the trust index of the interaction behavior of a first industrial terminal in a time slice, and the similarity between the trust index of the interaction behavior of the industrial terminal corresponding to the neighboring industrial terminal nodes in the dynamic trust graph corresponding to the first industrial terminal node in a time slice.

[0110] For example, the above-mentioned structural embedding vector is essentially used to represent the consistency of behavioral patterns between industrial terminals. If the similarity is low, it indicates that there is an abnormal correlation or suppression between the two, that is, low trust and high uncertainty.

[0111] In some embodiments, the first industrial terminal node corresponds to the first industrial terminal.

[0112] In some embodiments, the first industrial terminal is one of at least two industrial terminals.

[0113] In some embodiments, the industrial terminal trust assessment device calculates the trust index of the interaction behavior of the first industrial terminal and the similarity between the trust index of the interaction behavior of the industrial terminal corresponding to the neighboring industrial terminal nodes in the dynamic trust graph corresponding to the first industrial terminal node in a time slice, and performs weighted trust propagation and uncertainty propagation on the similarity to obtain the above-mentioned structural embedding vector.

[0114] In some embodiments, combined with Figure 4 ,like Figure 5 As shown, step 203a can be implemented through steps 203a1 to 203a4.

[0115] Step 203a1: The industrial terminal trust assessment device obtains the initial Gaussian embedding vector of each industrial terminal node in the first dynamic trust graph corresponding to the first time slice.

[0116] In some embodiments, the first dynamic trust graph is one of at least one dynamic trust graph.

[0117] For example, the trust assessment state performs linear mapping and nonlinear transformation on the multi-factor features of each industrial terminal node in the first dynamic trust graph to obtain an aligned intermediate representation. Then, by introducing sine and cosine basis extensions in a manner similar to random Fourier features, a more expressive feature representation is formed. ,in Based on this, the mean vector and log-variance vector of the Gaussian distribution are predicted through two sets of linear transformations, thereby obtaining the initial Gaussian embedding of the industrial terminal node. ,in This represents the semantic center of the industrial terminal in the multi-factor trust space, while This reflects the uncertainty of the model's judgment on trust in the industrial terminal. The larger the value, the less data is available or the more complex the behavior, making it more difficult to make an accurate judgment.

[0118] For example, the above-mentioned multi-factor feature vectors are used to characterize the multi-dimensional feature information of industrial terminals.

[0119] For example, prior to the above steps, a multi-factor feature vector needs to be constructed for each industrial terminal in the first dynamic trust graph. These include, but are not limited to: 1. Historical behavior factors, such as the number of connections initiated and received per unit time, the usage ratio of each industrial control protocol, the frequency of read / write / configuration commands, the proportion of abnormal connections, the number of historical alarms, and the number of policy violations; 2. Identity authentication factors, such as whether the current certificate is valid, the results of multi-factor authentication, the number of login failures, the credential rotation cycle, and whether there are shared accounts; 3. Access context factors, such as the sensitivity level of the target resource being accessed, the type of operation, whether the operation time is within a production shift or maintenance window, and whether the initiator and the target are in different security zones; 4. Environmental security factors, such as the IDS / IPS alarm density of the subnet in the recent period, whether there are confirmed compromised industrial terminals in the same process unit, and whether worm or ransomware activity has been detected in the upstream network.

[0120] Step 203a2: The industrial terminal trust assessment device maps the edge label of each directed edge to the first Gaussian embedding vector based on the initial Gaussian embedding vector of each industrial terminal node connected by each directed edge in the first dynamic trust graph, thereby obtaining the first Gaussian embedding vector of each directed edge.

[0121] In some embodiments, the first Gaussian embedding vector of a directed edge is used as a trust index to characterize the interaction behavior between two industrial terminals corresponding to a directed edge.

[0122] For example, by mapping industrial terminal nodes and their interaction edges, i.e. the aforementioned directed edges, to Gaussian distribution embeddings, multi-factor trust semantics and uncertainty can be expressed simultaneously in a unified probability space.

[0123] For example, edge labels or edge features are mapped using a set of independent Gaussian mapping networks. Gaussian embedding mapped to edges The aforementioned Gaussian mapping network includes K layers. In each layer Recalculate, relying only on the original edge labels, without backpropagating with node embeddings, to obtain the first Gaussian embedding vector mentioned above. , Let Gaussian mean vector of directed edges be obtained after K layers of mapping. The standard deviation of the directed edges obtained through K-layer mapping is used to provide multi-scale interactive semantic interpretation capabilities at different structural layers.

[0124] Understandably, the Gaussian mean vector of the directed edge can be regarded as the "trust / risk tendency" of the interaction behavior, while the standard deviation of the directed edge describes whether the alarm information is sufficient and consistent, and the stability of this type of behavior in history.

[0125] Step 203a3: The industrial terminal trust assessment device calculates the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edge where the neighboring industrial terminal nodes of the first industrial terminal node are located in the first dynamic trust graph, based on the first Gaussian embedding vector of the first industrial terminal node and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located.

[0126] In some embodiments, the Gaussian embedding similarity is used to characterize the similarity of the interaction behavior between the industrial terminal corresponding to the first industrial terminal node and the industrial terminals corresponding to the neighboring industrial terminal nodes in the first dynamic trust graph.

[0127] In some embodiments, the Gaussian embedding similarity includes cosine similarity and Jaccard similarity.

[0128] For example, the Jaccard similarity mentioned above is calculated by non-negative truncating the mean vector. Then, the product is obtained by summing the ratios of the minimum and maximum values ​​of the components along each dimension.

[0129] Step 203a4: The industrial terminal trust assessment device obtains the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal on the first time slice based on the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edges where other industrial terminal nodes are located.

[0130] In some embodiments, the industrial terminal trust assessment device performs a weighted sum of squares calculation on the cosine similarity and Jaccard similarity to obtain the confidence of the directed edge where the first industrial terminal node is located; then, it normalizes the confidence of the directed edge where the first industrial terminal node is located to obtain the defense coefficient; and then, based on the defense coefficient and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located, it calculates the structural embedding vector of the first industrial terminal on the first time slice.

[0131] In some embodiments, the aforementioned defense coefficient is used to constrain the degree of deviation in message transmission between the first industrial terminal and the corresponding industrial terminals of neighboring industrial terminal nodes.

[0132] It should be noted that if the cosine similarity between the directed edge containing the first industrial terminal node and the directed edges containing other industrial terminal nodes is less than a preset threshold, then the similarity is set to 0 before the subsequent normalization process is performed.

[0133] Thus, by stacking several layers (e.g., L=3) of such Gaussian graph convolutional layers, the impact of multi-hop trust paths on the trust level of industrial terminals can be captured in the local neighborhood, while uncertainty is propagated and attenuated along the trust path, forming an industrial terminal structural trust representation that takes into account both local structure and global correlation.

[0134] Step 203b: The industrial terminal trust assessment device constructs a time encoding vector corresponding to the first industrial terminal based on the structure embedding vector corresponding to the first industrial terminal in each time slice, according to the time sequence of the time slices.

[0135] In some embodiments, a hybrid absolute Gaussian-hourglass (HAGH) time position coding is used to construct the time coding vector corresponding to the first industrial terminal.

[0136] In some embodiments, the aforementioned time encoding vector preserves the absolute order information of time and can highlight key time periods in industrial control scenarios, thereby improving the model's sensitivity to these high-risk moments.

[0137] Step 203c: The industrial terminal trust assessment device obtains the trust status information of the first industrial terminal based on the time encoding vector corresponding to the first industrial terminal.

[0138] In some embodiments, the industrial terminal trust assessment device obtains a time-enhanced identifier by adding the time-encoded vector corresponding to the first industrial terminal to the structural embedding vector of the first industrial terminal. Subsequently, a multi-head self-attention module is used to nonlinearly model the behavior of the first industrial terminal across time slices. Then, each dimension of the input feature in the "time-enhanced identifier obtained by adding the time-encoded vector and the structural embedding vector" is expanded using a Chebyshev basis function for the nonlinear transformation of the KAN multi-head self-attention module. A weighted summation is then performed using a learnable parameter tensor to obtain a more expressive nonlinear transformation than traditional MLP. Next, within each attention head h, a causal mask is introduced, allowing only the current time slice to attend to historical time slices s≤t, and an attention score is calculated, which is then normalized using Softmax to obtain the weights. The value vectors are further weighted and summed to obtain the head output vector. After concatenating the head output vectors, another KAN transform is applied and connected to the residual to obtain the temporal context-enhanced representation. .Then and based on each industrial terminal With Time Slice Construct the residual vector and calculate the final temporal trust representation, i.e., the aforementioned trust state information.

[0139] In this way, the design enables the attention module to be good at capturing sudden events and discrete jumps, while the ODE module focuses on compensating for long-term gradual trends. The two work together to model the overall evolution trajectory of industrial terminal trust under complex operating conditions.

[0140] In some embodiments, combined with Figure 2 ,like Figure 6 As shown, after step 203 above, the industrial terminal trust assessment method provided in this application embodiment further includes steps 301 and 302.

[0141] Step 301: The industrial terminal trust assessment device generates a target security policy based on the trust status information of each industrial terminal.

[0142] In some embodiments, the industrial terminal trust assessment device separates the trustworthiness level and uncertainty index of each industrial terminal from the trust status information of each industrial terminal, and then rates the security events of each industrial terminal based on the trustworthiness level and uncertainty index of each industrial terminal.

[0143] For example, the above ratings include at least: high-level security incidents, medium-level security incidents, medium-high-level security incidents, medium-low-level security incidents, or low-level security incidents.

[0144] For example, the industrial terminal trust assessment device, for each sensitive operation initiated by an industrial terminal or a security event triggered, assigns a trust score to the industrial terminal based on the severity of the event. and uncertainty Construct a comprehensive risk score.

[0145] In some embodiments, the industrial terminal trust assessment device generates a corresponding target security strategy based on a comprehensive risk score.

[0146] It should be noted that the above rating description is illustrative, and the specific rating criteria may vary depending on the circumstances.

[0147] Step 302: The industrial terminal trust assessment device sends corresponding security operation instructions to all or some of the industrial terminals in at least two industrial terminals based on the target security policy.

[0148] In some embodiments, the above-mentioned safety operation instructions include at least one of the following:

[0149] Automatic driver isolation;

[0150] Process protection measures;

[0151] Emergency response procedures;

[0152] Strengthen auditing;

[0153] Fine-tuning of audit strategy.

[0154] Thus, by combining trust scoring with uncertainty into access control and event classification decision-making, a risk-adaptive security strategy of "cautiously allowing access when trust is high but uncertainty is low, and actively tightening access when trust is low or uncertainty is high" is achieved. This strategy is particularly suitable for industrial control system scenarios with massive industrial terminals, complex operating conditions, and constantly evolving attack patterns, significantly improving the overall security and operational stability of industrial control systems.

[0155] This application, based on an industrial terminal trust assessment method provided in this application, proposes a multi-factor adaptive trust assessment system for industrial control terminals based on uncertainty awareness, addressing the scenario of continuous access and operation management of massive industrial terminals in industrial control systems. Through unified modeling and continuous evaluation of multi-source trust evidence for industrial terminals, it forms an industrial terminal trust state that reflects the degree of trustworthiness and reliability, and uses this trust state for subsequent secure access control and risk management.

[0156] The following section will introduce the overall structure of the system and its various modules.

[0157] The overall system architecture is as follows Figure 7 As shown, the overall design adopts a layered approach, consisting of a data acquisition layer, a trust assessment layer, and a security control layer, forming a closed-loop operation through feedback and adaptive update mechanisms. Its core idea is to not simply view the trust status of industrial control terminals as a fixed score, but rather to model both "trustworthiness" and "reliability assessment" simultaneously, and to continuously evaluate and dynamically update the trust status of industrial terminals by combining the interaction relationships between industrial terminals and the time evolution process.

[0158] Unlike current industrial control security solutions that mainly rely on static identity authentication or treat trust assessment as an auxiliary function of access control, this application models trust assessment as a core system capability independently and explicitly supports multi-factor fusion, uncertainty perception, and continuous evolution of trust status at the system level, thereby improving the refinement and reliability of trusted management of industrial terminals in complex industrial control environments.

[0159] like Figure 7 As shown in the figure, the system provided in this application embodiment includes at least the following five functional modules, and the data flow and feedback relationship between the modules are represented by solid and dashed arrows.

[0160] (1) Multi-factor data acquisition and feature construction module (M1): Located in the data acquisition layer, it is used to acquire, align, and characterize multi-source data related to industrial control terminals, namely the aforementioned real-time multi-dimensional related data. M1 maps the aforementioned data into a unified multi-factor feature representation, namely the data feature information of the aforementioned multiple industrial terminals, as input evidence for subsequent trust assessment. In related technologies, most solutions only use static identity information or single behavioral features for assessment, which is difficult to comprehensively depict the real state of industrial control terminals under different operating stages and environmental conditions. This application introduces a multi-factor feature construction module at the system level, enabling trust assessment to cover multi-dimensional information such as identity, behavior, context, and environmental situation, providing a data foundation for subsequent adaptive assessment.

[0161] (2) Dynamic Trust Graph Construction Module (M2): Located in the trust assessment layer, this module constructs a dynamic trust graph between industrial terminals based on the multi-factor features output by M1. Each industrial control terminal is used as a graph node, and the communication relationships, control dependencies, or operational interactions between the industrial terminals are used as graph edges (i.e., the directed edges mentioned above). Combined with a time window mechanism, a dynamic graph structure that evolves over time is formed, resulting in a dynamic trust graph sequence containing the attributes, interaction relationships, and time information of the industrial terminal nodes. Compared to the current approach of treating industrial terminals as independent assessment objects, this application explicitly models the interaction relationships and temporal changes between industrial terminals through a dynamic graph structure. This enables trust assessment to reflect the real control links and associated risks in the industrial control system, laying a structural foundation for subsequent trust propagation and evolution modeling.

[0162] (3) Uncertainty-aware Trust Assessment Module (M3): This is the core module of this application, used to assess the trustworthiness of industrial terminals based on a dynamic trust graph, and output the trust status of industrial terminals, including trustworthiness and its uncertainty, i.e., the aforementioned trust status information. This module integrates and propagates multi-factor evidence, combines the interaction relationships and time evolution characteristics of industrial terminals, to form a continuous assessment result of the trust status of industrial terminals, and stores historical assessment statuses in a trust status database for subsequent updates and references. Existing industrial terminal trust assessment methods typically output deterministic trust scores, without characterizing the reliability of the assessment results themselves, which can easily lead to misjudgments in cases of insufficient or conflicting evidence. This application introduces an uncertainty-aware trust assessment module into the system architecture, so that the assessment results not only reflect the "trustworthiness" but also the "assessment credibility," thereby providing a more robust basis for subsequent security decisions.

[0163] (4) Trust Result-Driven Secure Access Control Module (M4): Located in the security management layer, it is used to implement hierarchical control over the access and operation behavior of industrial terminals based on the trust status of industrial terminals output by M3. This module maps the trust status of industrial terminals to corresponding access levels, access control policies, or event hierarchical response policies, and distributes control decisions to execution components such as zero-trust gateways, firewalls, or access control points to achieve dynamic constraints and risk control over the behavior of industrial terminals. Compared with traditional access control methods based on fixed policies or one-time authentication results, this application uses trust assessment results to drive secure access control, enabling industrial terminal permissions to be dynamically adjusted according to changes in trust status, which is more in line with the dual requirements of continuous operation and risk control in industrial control scenarios.

[0164] (5) Feedback and Adaptive Update Module (M5): This module collects the results of secure access control and handling, as well as the subsequently observed changes in industrial terminal behavior. It then feeds this information back to M1, M2, and M3 as feedback signals to update multi-factor characteristics, interaction relationships, and trust status, thus forming a closed-loop adaptive operation mechanism. In related technologies, trust assessment and actual handling results are often independent of each other, lacking self-correction capabilities over long-term operation. This application introduces a feedback and adaptive update module into the system architecture, enabling trust assessment to continuously reflect changes in the real state of industrial terminals, thereby enhancing the long-term stability and adaptability of the system in complex industrial control environments.

[0165] The following sections will introduce each module in detail:

[0166] 1) Multi-factor data acquisition and feature construction module

[0167] Before the trust assessment, the system first collects and characterizes multi-source information related to industrial control terminals.

[0168] This information includes not only the identity and asset attributes of industrial terminals, but also their behavioral patterns, access contexts, and overall security posture during actual operation. The multi-factor data acquisition and feature construction module is used to uniformly collect, organize, and characterize multi-source information related to industrial control terminals, providing basic trust evidence input for subsequent trust assessment. As mentioned above... Figure 7 As shown, this module acquires multidimensional data related to industrial terminals from the industrial control system operating environment and transforms it into a multi-factor feature representation that can be used for trust assessment modeling.

[0169] Specifically, the data collected by this module includes at least the following categories:

[0170] (1) Industrial control terminal data: including the identity, device type, firmware or configuration information of industrial terminals such as programmable logic controllers (PLCs), human machine interfaces (HMIs), engineering workstations, sensors and actuators;

[0171] (2) Network and protocol data: including industrial control protocol communication traffic, communication relationships between industrial terminals, and interactive behavior characteristics;

[0172] (3) Host and security event data: including host logs, alarm information and asset-related records;

[0173] (4) Environment and operating context data: including information such as the network area, time window, operating mode and current operating status of the industrial terminal.

[0174] Based on the data acquisition, this module performs standardization processing and feature construction on the aforementioned multi-source data to form a multi-factor feature representation of the industrial terminal. The feature representation covers at least the dimensions of industrial terminal identity information, behavioral characteristics, access context, and environmental situation, thereby reflecting the comprehensive status of the industrial terminal in the current operating stage.

[0175] Furthermore, to adapt to the characteristics of heterogeneous data sources, inconsistent acquisition frequencies, and missing data in industrial control environments, this module can perform time alignment and missing data compensation for data from different sources, and represent various features using a unified encoding and normalization method to ensure the consistency and comparability of multi-factor inputs in the subsequent trust assessment process.

[0176] Furthermore, the multi-factor features constructed by this module not only reflect the static attributes of industrial terminals, but can also be updated as the behavior of industrial terminals and the operating environment change, thereby providing a continuous and updatable foundation of trust evidence for subsequent trust assessment based on dynamic relationships and time evolution.

[0177] Compared with current technologies that mainly rely on static identity information or single behavioral characteristics as the basis for trust assessment, this application introduces a multi-factor data acquisition and feature construction module at the system level, enabling trust assessment to comprehensively utilize multi-dimensional information, reducing the risk of assessment distortion due to the failure of a single piece of evidence or incomplete information, and laying a data foundation for trust assessment of industrial terminals in complex industrial control scenarios.

[0178] 2) Dynamic Trust Graph Construction Module

[0179] After obtaining the multi-factor characteristics of industrial terminals, namely the aforementioned data feature information, the system further introduces a dynamic trust graph model to characterize the real-world interaction relationships between industrial control terminals and their time-varying characteristics. In this model, each industrial control terminal is abstracted as a node in the graph, and the communication, control, operation, or dependency relationships between industrial terminals are abstracted as directed edges. The system uses a time-slicing mechanism to divide the continuous operation process into a series of time slices, thereby constructing a dynamic graph sequence that evolves over time. This dynamic trust graph not only preserves the individual state information of industrial terminals but also explicitly expresses the control links and risk propagation paths between them, enabling trust assessment to be conducted within a unified framework of "industrial terminal—relationship—time," rather than evaluating individual industrial terminals in isolation.

[0180] Specifically, for each industrial terminal In discrete time slice Built-in multi-factor feature vectors These include, but are not limited to: 1. Historical behavior factors, such as the number of connections initiated and received per unit time, the usage ratio of each industrial control protocol, the frequency of read / write / configuration commands, the proportion of abnormal connections, the number of historical alarms, and the number of policy violations; 2. Identity authentication factors, such as whether the current certificate is valid, the results of multi-factor authentication, the number of login failures, the credential rotation cycle, and whether there are shared accounts; 3. Access context factors, such as the sensitivity level of the target resource being accessed, the type of operation, whether the operation time is within a production shift or maintenance window, and whether the initiator and the target are in different security zones; 4. Environmental security factors, such as the IDS / IPS alarm density of the subnet in the recent period, whether there are confirmed compromised industrial terminals in the same process unit, and whether worm or ransomware activity has been detected in the upstream network.

[0181] At the same time, for time slices The interaction between various industrial terminals in the process establishes a directed edge The existence of an edge indicates an industrial terminal. During this time slice, to industrial terminals It has initiated operations such as control commands, status reads, or file transfers. Based on associated security device alarms, access control policy matching results, and manual audit conclusions, each edge is assigned a trust label or a risk label. ,For example This indicates that the interaction behavior is considered normal and trustworthy. This indicates that the interaction exhibits significant abnormal characteristics or has been identified as malicious behavior. This is achieved by analyzing continuous time intervals. At fixed time intervals Slicing yields a series of time-ordered dynamic trust graphs. Each of the image snapshots Corresponding to a time slice, This is the collection of active industrial terminals during this time slice. This is the set of trust / risk interaction edges between industrial terminals observed within a time slice.

[0182] Compared with current technologies that treat industrial terminals as independent evaluation objects or only perform statistical analysis on interaction features within a fixed time slice, this application uses a dynamic trust graph to structurally model the interaction relationships between industrial terminals. This enables trust assessment to be conducted within a unified framework of "industrial terminal-relationship-time," thereby providing structured input for subsequent trust propagation, aggregation, and temporal evolution modeling, and improving the expressive power and robustness of trust assessment in complex industrial control environments.

[0183] 3) Uncertainty Perception Trust Assessment Module

[0184] This stage is the core innovative module of this application, proposing an uncertainty-aware industrial terminal trust assessment method. This method, instead of assigning a "definite trust score" to industrial control terminals during trust assessment, simultaneously judges how trustworthy the industrial terminal appears and how certain this judgment is. The system represents the trust state of each industrial terminal as a probabilistic outcome with uncertainty and performs joint calculations within a trust graph formed by the interaction relationships of the industrial terminals: industrial terminals with similar behavioral patterns and stable relationships mutually reinforce each other's trust; the influence of industrial terminals with abnormal behavior or abrupt associations is automatically weakened. In this way, the system can utilize the relationship information between industrial terminals while avoiding overconfident judgments when evidence is insufficient or information conflicts arise, thus obtaining more robust and reliable industrial terminal trust assessment results.

[0185] Specifically, the principle of this module is as follows: Figure 8 As shown, this method includes industrial terminal trust state modeling, structured propagation and aggregation of trust information, and joint modeling of the trust state evolution over time. By mapping multi-factor trust evidence from industrial control terminals to a unified probabilistic representation space, and combining the interaction relationships and time series characteristics between industrial terminals, the method continuously characterizes the trustworthiness of industrial terminals and its assessment uncertainty, thereby forming an assessment result that reflects the evolution of the trust state of industrial terminals. This method achieves comprehensive modeling of the uncertainty of multi-source evidence, the influence of industrial terminal interaction structures, and temporal dynamic changes within a unified framework, providing a foundation for trust assessment and risk control in industrial control scenarios.

[0186] (1) Uncertainty modeling of industrial terminals and interaction relationships based on Gaussian distribution:

[0187] First, industrial terminal nodes and their interaction edges are mapped to Gaussian distribution embeddings, thereby expressing multi-factor trust semantics and uncertainty simultaneously in a unified probability space.

[0188] For time slices Industrial terminals in First, its multi-factor characteristics By performing linear mapping and nonlinear transformation, an aligned intermediate representation is obtained. Then, by introducing sine and cosine basis extensions in a manner similar to random Fourier features, a more expressive feature representation is formed. ,in Based on this, the mean vector and log-variance vector of the Gaussian distribution are predicted respectively using two sets of linear transformations according to formula (1):

[0189] (1)

[0190] And order .

[0191] Thus, the initial Gaussian embedding of the industrial terminal node is obtained. ,in This represents the semantic center of the industrial terminal in the multi-factor trust space, while This reflects the uncertainty of the model's judgment on trust in the industrial terminal. The larger the value, the less data is available or the more complex the behavior, making it more difficult to make an accurate judgment.

[0192] For interactive edges This application also uses a set of independent Gaussian mapping networks to map edge labels or edge features. Gaussian embedding mapped to edges This mapping is in each layer. Recalculation relies solely on the original edge labels and does not involve backpropagation with node embeddings, thus providing multi-scale semantic interpretation capabilities for interactions across different structural layers. The Gaussian mean vector of an edge can be viewed as the "trust / risk tendency" of the interaction behavior, while the standard deviation of the edge characterizes whether the alarm information is sufficient and consistent, and the stability of this type of behavior in history.

[0193] (2) Trust propagation and aggregation submodule of robust adaptive similarity constraint

[0194] Next, the similarity of edges between Gaussian embeddings of industrial terminals is used for weighted and pruned to defend against attacks where malicious industrial terminals collaboratively forge trust links that affect the assessment results. In the... In layered graph convolution, for industrial terminals Incoming Neighbor Set Based on the mean embedding of the previous layer and Calculate the cosine similarity and Jaccard similarity, where the cosine similarity is defined by formula (2), as shown below:

[0195] (2)

[0196] Jaccard similarity is calculated by non-negative truncation of the mean vector. Then, according to the following formula (3), the ratio of the minimum and maximum values ​​of the components along the dimension is summed to obtain the result:

[0197] (3)

[0198] Among them, if Below the preset threshold If the two industrial terminals are considered to have significant differences in multi-factor behavior patterns, the corresponding edge may be a forged link or temporary abnormal connection inserted by the attacker, and its similarity is set to zero for subsequent normalization. The two similarities are fused in the form of a weighted sum of squares using the following formula (4) to obtain the comprehensive confidence of the edge, that is, the above Gaussian embedding similarity:

[0199] (4)

[0200] And normalize by the node's in-neighbors, and obtain the defense coefficient for message passing using the following formula (5):

[0201] (5)

[0202] This defense coefficient, on the one hand, enables stronger propagation of trust among similar industrial terminals, and on the other hand, by suppressing adjacent edges that deviate significantly from the subject's behavior pattern, it makes it difficult for attackers to significantly change the trust value of core devices by constructing a small number of malicious connections.

[0203] After obtaining the robust adaptive coefficients, i.e., the aforementioned defense coefficients, the structure graph convolutional layer performs message passing and aggregation in a Gaussian manner. Taking the ingress neighbor direction as an example, industrial terminals... In the The aggregation mean and standard deviation of the layers are as follows:

[0204]

[0205] Wherein, standard deviation is calculated as follows: The principle of linear scaling is applied to ensure that the uncertainty remains non-negative. In industrial control scenarios, industrial terminals may act as either trustors or trustees. Therefore, this application aggregates the ingress and egress neighbors separately, concatenates the four types of mean and standard deviation vectors from node embeddings and edge embeddings, and then updates them into new node Gaussian embeddings through linear transformation and ReLU activation. By stacking several layers (e.g.) This type of Gaussian graph convolutional layer can capture the impact of multi-hop trust paths on the trust level of industrial terminals in the local neighborhood, while propagating and attenuating uncertainty along the trust path, forming an industrial terminal structure trust representation that takes into account both local structure and global correlation.

[0206] (3) Sub-module for continuous modeling of trust state of industrial terminals in the time-evolution direction

[0207] After obtaining the industrial terminal structure embeddings for each time slice, this stage models the evolution of trust over time. (This refers to the process of embedding industrial terminals.) In time slice structural embedding Introducing the Mixed Absolute Gaussian-Hourglass (HAGH) time position coding, the time coding vector is constructed using formula (6):

[0208] (6)

[0209] in Given a trainable absolute time position matrix, These are trainable parameters for the Gaussian peak position and width. For the corresponding weight vector, The time window is centered. This encoding preserves the absolute order of time while highlighting critical time periods in industrial control scenarios that overlap with process switching, start-up / shutdown operations, or maintenance windows, thereby improving the model's sensitivity to these high-risk moments. The time encoding is then superimposed on the structural embedding to obtain the time-enhanced representation. .

[0210] Subsequently, this application utilizes a causal multi-head self-attention module constructed using a Kolmogorov–Arnold Network (KAN) based on Chebyshev polynomials (CP) to nonlinearly model the behavioral dependencies of industrial terminals across time slices. After normalizing the input features, a recursive relation is adopted: A set of Chebyshev Basis Functions (CBFs) is generated, each feature dimension is expanded, and a weighted sum is performed using a learnable parameter tensor to obtain a more expressive nonlinear transformation than traditional MLPs, which is used to construct query vectors. Key vector and value vector In each attention head Internally, a causal mask is introduced to allow only the current time slice to focus on historical time slices. And the attention score is calculated using the following formula (7):

[0211] (7)

[0212] The weights are then obtained by Softmax normalization. Further weighted summation of the value vectors yields the head output. After concatenating the outputs of each header, a temporal context-enhanced representation is obtained by connecting it to the residual through another KAN transform layer. This enables the model to capture complex time dependencies such as "a sudden occurrence of highly sensitive operation after a long period of stability in an industrial terminal" and "a sudden pattern of abnormally concentrated occurrence of multiple adjacent time windows within a short period of time".

[0213] To further characterize the smooth, gradual aspects of trust evolution, this application introduces an ordinary differential equation (ODE) residual module to model the difference between structural embeddings and attention-enhanced representations in continuous time. For each industrial terminal... With Time Slice The residual vector is constructed using formula (8):

[0214] (8)

[0215] Treat it as virtual time Given the initial state, define the differential equation.

[0216]

[0217] in Given a vector field parameterized by a small neural network, the state is evolved to the form through numerical integration. Obtain the ODE refining residual Then, the final temporal trust representation is obtained by adding it to the attention enhancement representation using formula (9), which is the trust evaluation information mentioned above:

[0218] (9)

[0219] This design enables the attention module to excel at capturing sudden events and discrete jumps, while the ODE module focuses on compensating for long-term gradual trends. The two work together to model the overall evolution trajectory of industrial terminal trust under complex operating conditions.

[0220] 4) Trust scoring-driven secure access control and adaptive update module

[0221] After obtaining the comprehensive temporal trust representation of industrial terminals, the idea in this stage is to use the previously calculated "industrial terminal trust score" as the sole decision-making basis to control what industrial terminals can do: industrial terminals with high trust are allowed normal access and operation; industrial terminals with medium trust have their permissions restricted or are subject to enhanced monitoring; and industrial terminals with low trust are directly denied access or isolated. Simultaneously, each behavior of the industrial terminal, environmental change, and security event updates the trust score in reverse, allowing the access policy to be dynamically adjusted over time, achieving an adaptive security control mechanism that is "not a one-time fatal judgment, but continuous evaluation and adjustment as needed." Specifically, this stage maps it to an interpretable trust score and uncertainty metric, and uses this to drive secure access policies and tiered responses to security events. For industrial terminals... At the present moment The representation of The trust score is output based on Sigmoid activation through one or more feedforward networks: .in, The larger the value, the more reliable the industrial terminal.

[0222] Simultaneously, industrial-level uncertainty indicators can be extracted from the standard deviation vector in the structural embedding, for example: .

[0223] Given the extremely high requirements for "production continuity" in industrial settings, to avoid uncertainty in model cognition caused by a lack of historical behavior data for newly connected legitimate equipment, Extremely high risk sensitivity, leading to a sharp drop in scores and triggering false blocking, necessitates this application to introduce a dynamic risk sensitivity coefficient based on identity weights. The revised formula for calculating the effective trust score (10) is as follows:

[0224] (10)

[0225] In the formula It represents the current identity authentication strength of industrial terminals, covering multiple dimensions such as two-way digital certificate verification, physical port binding consistency, and private protocol handshake success rate. Designed for about It is a monotonically decreasing function. Its core logic lies in: when the industrial terminal passes a high level of strong authentication (i.e., ... When it is relatively high, The value will automatically decrease, even approaching 0. This means the system temporarily tolerates the unknown behavioral risks of new devices, prioritizing access. Conversely, when industrial terminal authentication is weak, Maintain a high level of trust, significantly lower the trust score by leveraging uncertainties, and strictly limit trial access by unknown devices.

[0226] Based on the calculation Regarding size and authentication status, this application pre-sets a multi-level access control and response strategy. The first is the "secure and trusted status," when... When the threshold is exceeded, the industrial terminal is deemed safe and allowed to perform all read, write, control, and configuration operations according to the established process.

[0227] Furthermore, for each sensitive operation initiated or security event triggered by an industrial terminal, this application assesses the severity of the event and the trust score of the initiating industrial terminal. and uncertainty The comprehensive risk score is constructed using formula (11):

[0228] (11)

[0229] Then according to Security events are categorized into different levels based on their magnitude. High-level events will directly drive automatic isolation, process protection measures, and emergency response procedures, while low- to medium-level events may trigger enhanced auditing or policy fine-tuning. The results of event handling (such as false alarms, missed alarms, and handling effectiveness) and subsequent observed industrial terminal behaviors will be fed back to the graph construction and model training module in the form of labels or weights. This will iteratively update the multi-factor feature weights, edge labels, and model parameters of the industrial terminals, forming an adaptive closed loop of "trust assessment—secure access—event response—model retraining".

[0230] In summary, this application models industrial control terminals and their interactions as a dynamic Gaussian graph and introduces a deep Gaussian message passing mechanism, enabling the interpretable propagation and aggregation of trust semantics and uncertainty in the graph. Through a robust adaptive similarity coefficient analysis mechanism, edge weighting and pruning are applied, significantly improving the system's robustness against attacks such as forged trust links, collaborative trust manipulation, or malicious negative reviews. A three-layer temporal modeling framework, consisting of hybrid temporal coding, KAN nonlinear temporal attention, and ODE residual modules, captures trust jumps caused by sudden anomalies and depicts the slow evolution of industrial control terminals over long-term operation. By jointly introducing trust scoring and uncertainty into access control and event-level decision-making, a risk-adaptive security strategy is implemented: "cautiously allowing access when trust is high but uncertain, and actively tightening access when trust is low or uncertainty is high." This strategy is particularly suitable for industrial control system scenarios with massive numbers of industrial terminals, complex operating conditions, and constantly evolving attack patterns, significantly improving the overall security and operational stability of the industrial control system.

[0231] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0232] Regarding the information evaluation method provided in this application embodiment, the following content is specifically protected:

[0233] 1) Overall Architecture of Multi-Factor Adaptive Trust Evaluation System for Industrial Control Terminals Based on Uncertainty Awareness

[0234] This application proposes an industrial terminal trust assessment system architecture for industrial control scenarios. The system includes at least a multi-factor data acquisition and feature construction module, a dynamic trust graph construction module, an uncertainty-aware trust assessment module, and a trust result output and strategy linkage module. The system takes multi-source trust evidence from industrial terminals as input and the trust status (credibility and uncertainty) of the industrial terminals as output, enabling continuous assessment and dynamic updating of the trustworthiness of industrial control terminals.

[0235] 2) Unified construction mechanism for industrial terminal features based on multi-factor trust evidence

[0236] This application constructs a multi-factor feature representation that reflects the comprehensive state of industrial control terminals by uniformly modeling multi-factor trust evidence, including identity information, behavioral characteristics, access context, and environmental status. This mechanism overcomes the limitations of existing technologies that rely solely on static identity or single behavioral characteristics for trust assessment, providing multi-dimensional and updatable foundational trust evidence for subsequent trust modeling.

[0237] 3) Dynamic Trust Graph Modeling Method for Interaction Relationships of Industrial Control Terminals

[0238] This application proposes a dynamic trust graph construction method, which maps industrial control terminals as graph nodes, maps the communication, control or operation and maintenance interaction relationships between industrial terminals as graph edges, and introduces a time window mechanism to form a dynamic graph sequence, thereby simultaneously depicting the individual state of industrial terminals, the relationship between industrial terminals and their time-varying characteristics in a unified structure.

[0239] 4) A joint modeling method for trust status and uncertainty in industrial terminals based on probabilistic representation

[0240] This application introduces probabilistic modeling into the trust assessment process, representing the trust status of industrial terminals as a joint representation that includes both credibility and uncertainty. Uncertainty is used to characterize the reliability of the trust assessment conclusion, reflecting situations such as insufficient trust evidence, conflicting evidence, or fluctuations in industrial terminal behavior, thus avoiding the potential risks associated with representing the trust status of industrial terminals solely with a single deterministic score.

[0241] 5) Trust propagation and aggregation methods with robust constraint mechanisms

[0242] In the process of trust assessment of industrial terminals, this application applies robust constraints to the interaction relationships of industrial terminals and regulates the propagation and aggregation process of trust information in the graph structure. This suppresses the impact of abnormal or unreliable interaction relationships on the assessment results, thereby improving the stability and reliability of trust assessment results in the presence of noisy data, abnormal correlations, or potential attack behaviors.

[0243] 6) Temporal evolution modeling and continuous update mechanism of trust state in industrial terminals

[0244] This application achieves the evolutionary characterization of the trust status of industrial terminals as the operational stage changes by continuously modeling the trust status of industrial terminals over time. This enables the trust assessment results to reflect long-term trends and phased changes, rather than just instantaneous judgments based on discrete moments, thus enhancing the adaptability to changes in complex industrial control conditions.

[0245] 7) Security access control and policy linkage mechanism based on trust assessment results

[0246] This application uses the trust assessment results of industrial terminals as the basis for secure access control and policy adjustment, enabling the access permissions of industrial terminals to be dynamically adjusted according to their current trust status and uncertainty level, thereby achieving synergistic linkage between trust assessment and security management, and improving the overall security and controllability of the industrial control system.

[0247] It should be noted that there are alternative solutions to the solutions in the embodiments of this application, which are described in detail below:

[0248] Alternative Solution 1: An Alternative Implementation of Uncertainty Modeling Methods

[0249] In the process of determining the trust status information described above, the trust status of the industrial terminal is modeled probabilistically to characterize its credibility and uncertainty. Without altering the overall technical concept of this application, the uncertainty of the industrial terminal's trust status can also be characterized using other forms of probability or interval representation, such as using interval values, confidence intervals, or fuzzy membership functions to describe the trust status, thereby reflecting the reliability of the trust assessment results. All of the above methods can achieve an explicit expression of the uncertainty in trust assessment, thus achieving the same technical objective as this application.

[0250] Alternative Solution 2: An alternative implementation of the industrial terminal interaction relationship modeling method

[0251] In the process of modeling the relationships between industrial terminals using a dynamic graph structure, without departing from the core ideas of this application, the interaction relationships between industrial terminals can also be characterized using other structured representation methods, such as multi-layer relation matrices, temporal relation networks, or hierarchical topology models, to describe the communication, control, or collaboration relationships between industrial terminals. These alternative methods can also reflect the relationships between industrial terminals and their characteristics changing over time, thereby supporting relationship-based trust assessment.

[0252] Alternative Solution 3: Implementation of an Alternative Mechanism for Trust-Based Information Fusion and Dissemination

[0253] In the process of achieving multi-factor fusion through the propagation and aggregation of trust information within the industrial terminal relationship structure, other trust fusion mechanisms can be employed without altering the technical objective of this application. These include rule-constrained multi-factor weighted fusion, relational dependency modeling based on statistical models, or trust propagation methods based on probabilistic inference networks, to comprehensively evaluate the trust information of the industrial terminals. These alternative methods can achieve the fusion and propagation of multi-factor trust information under different implementation conditions.

[0254] Alternative Solution 4: An Alternative Implementation of the Trust State Temporal Evolution Model

[0255] In the process of continuously updating the trust state of industrial terminals through time evolution modeling, without departing from the purpose of this application, the time evolution of the trust state can also be achieved through other methods, such as using a sliding time window, a recursive update model, or a historical state weighting mechanism to update and correct the trust state of industrial terminals. These alternative solutions can also characterize the changing trend of the trust state of industrial terminals, meeting the needs for continuous evaluation in industrial control scenarios.

[0256] Alternative Solution 5: An alternative implementation of the linkage between trust assessment results and security control.

[0257] In the process of using trust assessment results to drive secure access control of industrial terminals, without changing the overall technical objectives of this application, the trust assessment results can also be used for other forms of security management or operational control, such as industrial terminal behavior auditing, risk warning classification, policy priority adjustment, or operation and maintenance permission management. All of the above alternative methods can effectively control the operational risks of industrial control systems based on the trust status of industrial terminals.

[0258] Furthermore, the multi-factor adaptive trust assessment technology for industrial control terminals based on uncertainty perception proposed in this application has a clear engineering implementation path and high feasibility for implementation. It can be effectively integrated with existing industrial control systems and security protection systems, and is ready for deployment and operation in actual industrial scenarios. Its feasibility for implementation is mainly reflected in the following aspects.

[0259] First, from a system architecture perspective, this application adopts a modular and layered design approach, decoupling functions such as multi-factor data acquisition, industrial terminal relationship modeling, trust assessment, and security control. Each module interacts through clearly defined data interfaces, enabling deployment as an independent component or service within the existing industrial control network architecture. This design approach aligns with the current mainstream industrial control security platforms and industrial internet platforms, facilitating gradual integration and expansion without impacting the stable operation of existing production systems.

[0260] Secondly, regarding data sources and engineering implementation conditions, the industrial terminal identity information, network and industrial control protocol data, host and security event information, and environmental and operational context data required by this application all originate from readily available data resources in existing industrial control systems and industrial networks, such as industrial control protocol parsing, network traffic monitoring, asset management systems, and security audit systems. This data has been widely collected and used in existing industrial security products and platforms. This application builds upon this data for modeling and analysis, without relying on additional dedicated hardware or difficult-to-obtain external data, thus possessing practical feasibility.

[0261] Furthermore, from the perspective of computational and performance constraints, the trust assessment process in this application can be implemented in a layered or distributed manner depending on the actual deployment environment. For example, multi-factor feature construction and preliminary relationship modeling can be completed at the edge, while trust assessment and policy decision-making can be completed at the central side or management platform, thereby meeting the real-time and stability requirements of industrial control systems. Simultaneously, by introducing structured modeling and continuous update mechanisms, this application avoids redundant calculations of all historical data, which helps control computational overhead and adapts to the long-term continuous operation requirements of industrial control scenarios.

[0262] Furthermore, in terms of compatibility with existing security mechanisms, the industrial terminal trust status output in this application can be directly interfaced with existing access control, access control, auditing, and alarm systems to drive security management actions such as permission classification, policy adjustment, or risk handling, without requiring modifications to the underlying control logic or the industrial equipment itself. This decoupled "assessment-decision-execution" approach helps reduce deployment risks and improves acceptability in real-world industrial environments.

[0263] Finally, considering application scenarios and promotion conditions, the technical solution proposed in this application is applicable to multiple industrial fields such as energy, power, petrochemicals, and intelligent manufacturing, and can cover industrial control system environments of different scales and topologies. Its trust assessment-centric technical approach aligns with the current development trends of the Industrial Internet and zero-trust security, possessing significant promotional value and promising engineering application prospects.

[0264] In summary, the technical solution presented in this application has strong feasibility in terms of system architecture, data acquisition, engineering implementation, performance adaptation, and industry application. It can be smoothly deployed and applied on the basis of the existing industrial control security system, and has high engineering practical value.

[0265] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0266] This application embodiment can divide the industrial terminal trust assessment device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0267] In some embodiments, this application also provides an industrial terminal trust assessment device. This industrial terminal trust assessment device may include one or more functional modules for implementing the industrial terminal trust assessment method of the above method embodiments.

[0268] For example, Figure 9 This is a schematic diagram of the structure of an industrial terminal trust assessment device provided in an embodiment of this application. Figure 9 As shown, the industrial terminal trust assessment device 900 includes: an acquisition module 901, a construction module 902, and a processing module 903. The acquisition module 901 is used to acquire the interaction feature information of at least two industrial terminals based on interaction-related data of at least two industrial terminals within a predetermined time period. The interaction feature information of each industrial terminal includes the identity information of the industrial terminal, the interaction behavior information of the industrial terminal, the access context information of the industrial terminal, and the environmental situation information of the trust environment in which the industrial terminal is currently located. The construction module 902 is used to construct a dynamic trust graph based on the interaction feature information of the at least two industrial terminals. The dynamic trust graph is used to characterize the control link and risk propagation path between the at least two industrial terminals within the predetermined time period. The processing module 903 is used to evaluate the trustworthiness of each industrial terminal based on the dynamic trust graph and output the trust status information of each industrial terminal.

[0269] In the industrial terminal trust assessment device provided in this application embodiment, this application models the industrial control terminal and the interaction relationship between industrial terminals as a dynamic trust graph, and introduces trust scoring and uncertainty into access control and event classification decision-making, thereby realizing a risk-adaptive security strategy in the industrial control system and improving the refinement and reliability of industrial terminal trust management in the industrial control environment.

[0270] In some embodiments, the predetermined time period includes at least one time slice, the dynamic trust graph includes at least one dynamic trust graph, and one dynamic trust graph corresponds to one time slice within the predetermined time period; the dynamic trust graph includes industrial terminal nodes corresponding to the at least two industrial terminals and at least one directed edge, each directed edge is provided with an edge label, each directed edge connects the industrial terminals corresponding to the industrial terminal nodes and there is interactive behavior between them, the indication direction of each directed edge is used to characterize the direction of the execution of interactive behavior between the industrial terminals corresponding to the directed edge, and the edge label of a directed edge is used to indicate the trust index of the interactive behavior between the industrial terminals corresponding to the directed edge, the trust index including trust tendency or trust risk.

[0271] In other embodiments, the construction module 902 is specifically used to: establish directed edges between industrial terminal nodes corresponding to industrial terminals that have interactive behavior within the first time slice, based on the interaction feature information of the at least two industrial terminals within the first time slice; add edge labels to each directed edge according to the security device alarms, access control policy matching results and manual audit conclusions associated with each directed edge, and construct a dynamic trust graph corresponding to the first time slice; wherein the first time slice is one of the at least one time slice.

[0272] In other embodiments, the processing module 903 is specifically configured to: determine a structure embedding vector corresponding to the first industrial terminal in each time slice based on each dynamic trust graph; wherein, a structure embedding vector is used to characterize the trust index of the interaction behavior of the first industrial terminal in a time slice, and the similarity between the trust index of the interaction behavior of the first industrial terminal node and the industrial terminal corresponding to the neighboring industrial terminal node in the dynamic trust graph corresponding to the time slice; the first industrial terminal node corresponds to the first industrial terminal; construct a time encoding vector corresponding to the first industrial terminal based on the structure embedding vector corresponding to the first industrial terminal in each time slice according to the temporal sequence of the time slices; obtain the trust state information of the first industrial terminal based on the time encoding vector corresponding to the first industrial terminal; wherein, the first industrial terminal is one of the at least two industrial terminals.

[0273] In some embodiments, the processing module 903 is specifically used to: obtain the initial Gaussian embedding vector of each industrial terminal node in the first dynamic trust graph corresponding to the first time slice, wherein the first dynamic trust graph is one of the at least one dynamic trust graphs; based on the initial Gaussian embedding vector of each directed edge connecting the industrial terminal nodes in the first dynamic trust graph, map the edge label of each directed edge to a first Gaussian embedding vector to obtain the first Gaussian embedding vector of each directed edge; the first Gaussian embedding vector of a directed edge is used to characterize the trust index of the interaction behavior between the two industrial terminals corresponding to the directed edge; based on the first Gaussian embedding vector of the directed edge where the first industrial terminal node is located, and the Gaussian embedding vector of the directed edge where the neighboring industrial terminal nodes of the first industrial terminal node are located in the first dynamic trust graph, calculate the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edges where the other industrial terminal nodes are located; based on the Gaussian embedding similarity, obtain the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice.

[0274] In some embodiments, the Gaussian embedding similarity includes cosine similarity and Jaccard similarity; the processing module 903 is specifically used to: calculate a weighted sum of squares on the cosine similarity and the Jaccard similarity to obtain the confidence of the directed edge where the first industrial terminal node is located; normalize the confidence of the directed edge where the first industrial terminal node is located to obtain a defense coefficient, which is used to constrain the degree of deviation in message transmission between the first industrial terminal and the corresponding industrial terminals of the neighboring industrial terminal nodes; and calculate the structural embedding vector of the first industrial terminal on the first time slice based on the defense coefficient and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located.

[0275] In some embodiments, combined with Figure 9 ,like Figure 10 As shown, the above-mentioned device further includes: a sending module 904; the processing module 903 is further configured to evaluate the trustworthiness of each industrial terminal based on the above-mentioned dynamic trust graph, output the trust status information of each industrial terminal, and generate a target security policy based on the trust status information of each industrial terminal; the sending module 904 is configured to send corresponding security operation instructions to all or some of the industrial terminals among the above-mentioned at least two industrial terminals based on the above-mentioned target security policy.

[0276] It should be noted that the industrial terminal trust assessment device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0277] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 11 As shown, the electronic device 90 includes: a processor 92, a communication interface 93, and a bus 94. Optionally, the electronic device 90 may also include a memory 91.

[0278] Processor 92 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0279] Communication interface 93 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0280] The memory 91 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0281] As one possible implementation, the memory 91 can exist independently of the processor 92. The memory 91 can be connected to the processor 92 via a bus 94 and is used to store instructions or program code. When the processor 92 calls and executes the instructions or program code stored in the memory 91, it can implement the industrial terminal trust assessment method provided in the embodiments of this application.

[0282] In another possible implementation, memory 91 can also be integrated with processor 92.

[0283] Bus 94 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 94 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0284] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0285] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described industrial terminal trust assessment method embodiment and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0286] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0287] This application also provides a readable storage medium storing a program or instructions that, when executed by a computer, implement the industrial terminal trust assessment method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; the readable storage medium can be any of the foregoing embodiments or memory; the readable storage medium can also be an external storage device of the service invocation device, such as a pluggable hard drive, SmartMedia Card (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0288] This application also provides a computer program product, which is stored in a storage medium and, when executed by a computer, implements the industrial terminal trust assessment method provided in the above embodiments.

[0289] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0290] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause an industrial terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0291] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for assessing trust in industrial terminals, characterized in that, include: Based on the interaction-related data of at least two industrial terminals within a predetermined time period, the interaction feature information of the at least two industrial terminals is obtained. The interaction feature information of each industrial terminal includes the identity information of the industrial terminal, the interaction behavior information of the industrial terminal, the access context information of the industrial terminal, and the environmental situation information of the trust environment in which the industrial terminal is currently located. Based on the interaction feature information of the at least two industrial terminals, a dynamic trust graph is constructed. The dynamic trust graph is used to characterize the control link and risk propagation path between the at least two industrial terminals within the predetermined time period. Based on the dynamic trust graph, the trust level of each industrial terminal is evaluated, and the trust status information of each industrial terminal is output.

2. The industrial terminal trust assessment method according to claim 1, characterized in that, The predetermined time period includes at least one time slice, and the dynamic trust graph includes at least one dynamic trust graph, with one dynamic trust graph corresponding to one time slice within the predetermined time period. The dynamic trust graph includes industrial terminal nodes corresponding to the at least two industrial terminals and at least one directed edge. Each directed edge is labeled, and there is interaction behavior between the industrial terminals corresponding to each directed edge. The direction of each directed edge is used to characterize the behavior direction in the execution interaction behavior between the industrial terminals corresponding to the directed edge. The edge label of a directed edge is used to indicate the trust index of the interaction behavior between the industrial terminals corresponding to the directed edge. The trust index includes trust tendency or trust risk.

3. The industrial terminal trust assessment method according to claim 2, characterized in that, The construction of a dynamic trust graph based on the interaction feature information of the at least two industrial terminals includes: Based on the interaction feature information of at least two industrial terminals within the first time slice, directed edges are established between the industrial terminal nodes corresponding to the industrial terminals that have interactive behavior within the first time slice. Based on the security device alarms, access control policy matching results, and manual audit conclusions associated with each directed edge, add edge labels to each directed edge and construct a dynamic trust graph corresponding to the first time slice; The first time slice is one of the at least one time slices.

4. The industrial terminal trust assessment method according to claim 2 or 3, characterized in that, The process of evaluating the trustworthiness of each industrial terminal based on the dynamic trust graph and outputting the trust status information of each industrial terminal includes: Based on each dynamic trust graph, a structural embedding vector is determined for the first industrial terminal in each time slice; wherein, a structural embedding vector is used to characterize the trust index of the interaction behavior of the first industrial terminal in a time slice, and the similarity between the trust index of the interaction behavior of the first industrial terminal node and the industrial terminal corresponding to the neighboring industrial terminal node in the dynamic trust graph of the time slice; the first industrial terminal node corresponds to the first industrial terminal. According to the time sequence of the time slices, based on the structure embedding vector corresponding to the first industrial terminal in each time slice, a time encoding vector corresponding to the first industrial terminal is constructed. Based on the time-encoded vector corresponding to the first industrial terminal, the trust status information of the first industrial terminal is obtained. The first industrial terminal is one of the at least two industrial terminals.

5. The industrial terminal trust assessment method according to claim 4, characterized in that, The step of determining the structure embedding vector corresponding to the first industrial terminal in each time slice based on each dynamic trust graph includes: Obtain the initial Gaussian embedding vector of each industrial terminal node in the first dynamic trust graph corresponding to the first time slice, wherein the first dynamic trust graph is one of the at least one dynamic trust graph; Based on the initial Gaussian embedding vector of each industrial terminal node connected by each directed edge in the first dynamic trust graph, the edge label of each directed edge is mapped to the first Gaussian embedding vector to obtain the first Gaussian embedding vector of each directed edge; the first Gaussian embedding vector of a directed edge is used to characterize the trust index of the interaction behavior between the two industrial terminals corresponding to the directed edge. Based on the first Gaussian embedding vector of the directed edge where the first industrial terminal node is located, and the Gaussian embedding vector of the directed edge where the neighboring industrial terminal nodes of the first industrial terminal node are located in the first dynamic trust graph, the Gaussian embedding similarity between the directed edge where the first industrial terminal node is located and the directed edges where the other industrial terminal nodes are located is calculated. Based on the Gaussian embedding similarity, the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice is obtained.

6. The industrial terminal trust assessment method according to claim 5, characterized in that, The Gaussian embedding similarity includes: cosine similarity and Jaccard similarity; The step of obtaining the structural embedding vector of the first industrial terminal corresponding to the first industrial terminal node in the first time slice based on the Gaussian embedding similarity includes: The confidence level of the directed edge containing the first industrial terminal node is obtained by performing a weighted sum of squares calculation on the cosine similarity and the Jaccard similarity. The confidence of the directed edge where the first industrial terminal node is located is normalized to obtain the defense coefficient. The defense coefficient is used to constrain the degree of deviation in message transmission between the first industrial terminal and the corresponding industrial terminals of the neighboring industrial terminal nodes. Based on the defense coefficient and the Gaussian embedding vector of the directed edge where the first industrial terminal node is located, the structural embedding vector of the first industrial terminal on the first time slice is calculated.

7. The industrial terminal trust assessment method according to claim 1, characterized in that, After evaluating the trustworthiness of each industrial terminal based on the dynamic trust graph and outputting the trust status information of each industrial terminal, the method further includes: Based on the trust status information of each industrial terminal, a target security policy is generated; Based on the target security policy, corresponding security operation instructions are sent to all or some of the industrial terminals in the at least two industrial terminals.

8. An industrial terminal trust assessment device, characterized in that, include: Acquisition module, construction module, and processing module; The acquisition module is used to acquire the interaction feature information of at least two industrial terminals based on the interaction-related data of at least two industrial terminals within a predetermined time period. The interaction feature information of each industrial terminal includes the identity information of the industrial terminal, the interaction behavior information of the industrial terminal, the access context information of the industrial terminal, and the environmental situation information of the trust environment in which the industrial terminal is currently located. The construction module is used to construct a dynamic trust graph based on the interaction feature information of the at least two industrial terminals. The dynamic trust graph is used to characterize the control link and risk propagation path between the at least two industrial terminals within the predetermined time period. The processing module is used to evaluate the trustworthiness of each industrial terminal based on the dynamic trust graph and output the trust status information of each industrial terminal.

9. An electronic device, characterized in that, The system includes a processor and a memory, the memory storing programs or instructions executable on the processor, which, when executed by the processor, implement the method described in any one of claims 1 to 7. An industrial terminal trust assessment method.

10. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a computer, implement the industrial terminal trust assessment method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the industrial terminal trust assessment method as described in any one of claims 1 to 7.

Images