An attack rule generation and detection simulation method, system, storage medium and equipment based on an ATT&CK mapping power monitoring system

Abstract

The application discloses a power monitoring system attack rule generation and detection simulation method and system based on ATT&CK mapping, a storage medium and equipment, and belongs to the technical field of power system network security and dispatching automation. In view of the problems that multi-source security data is difficult to be uniformly expressed, attack semantics lacks standardized mapping, rules rely on manual writing, and there is no closed-loop simulation verification in the prior art, the application collects multi-source security data of a power monitoring system and converts the multi-source security data into unified structured events, extracts standardized basic behaviors, and then constructs a power-specific ATT&CK mapping rule library, automatically generates attack rules in combination with multi-dimensional constraints, outputs attack results through multi-entity correlation detection, and then deploys the rules to a simulation environment for verification, iteratively optimizes the rules according to detection and simulation indexes to form a closed loop. The application improves the standardization, interpretability and engineering adaptability of attack detection of the power monitoring system, and can effectively identify composite attack behaviors.

Description

Technical Field

[0001] This invention relates to the interdisciplinary field of power system network security and dispatch automation, specifically to a method, system, storage medium, and device for generating and simulating attack rules for power monitoring systems based on ATT&CK mapping. It is applicable to attack behavior extraction, automatic rule generation, multi-entity association detection, and simulation verification in scenarios involving objects such as master stations, substations, dispatch data networks, remote terminals, engineering stations, operation and maintenance access links, and boundary protection equipment. Background Technology

[0002] Power monitoring systems undertake key functions such as issuing dispatch commands, collecting remote signaling and telemetry data, executing remote control commands, controlling automatic generation and voltage, coordinating station control with other systems, and providing security isolation and protection. They are characterized by high real-time performance, heterogeneous data types, dedicated protocols, clear boundary layering, and long business links. With the increasing accessibility of maintenance personnel, interconnected devices, and cross-regional data exchange, attackers can launch complex attacks on power monitoring systems using weak passwords, abnormal access, vulnerability exploitation, remote command execution, lateral propagation, and abnormal cross-regional access.

[0003] Most existing attack detection methods are geared towards general information network environments, typically relying on static signatures, single-type log alarms, or single-point traffic anomalies for judgment. They fail to fully consider the roles, business semantics, and boundary relationships of objects in power monitoring systems, resulting in the following shortcomings: First, the data formats output by the master station, substations, dispatch data networks, remote terminals, and boundary security devices differ significantly, making it difficult to model events uniformly. Second, there is a lack of fine-grained mapping between underlying events and upper-layer ATT&CK attack semantics, hindering the standardization, merging, and phased analysis of alarm results. Third, complex attacks are often formed by the chaining of multiple discrete behaviors, and existing rules mostly rely on manual writing, making it difficult to adapt to changes in scenarios and rule expansion. Fourth, existing methods typically perform detection directly on production systems, lacking simulation verification and parameter feedback mechanisms before and after rule deployment, making it difficult to conduct closed-loop evaluation of rule effectiveness, timeliness, and adaptability.

[0004] Therefore, there is an urgent need to propose a feasible technical solution that can both construct a unified behavioral representation for multi-source security data of power monitoring systems and realize a closed loop of ATT&CK semantic mapping, automatic rule generation, multi-entity association detection, and simulation verification. Summary of the Invention

[0005] The purpose of this invention is to address the problems existing in the prior art, such as the difficulty in uniformly representing multi-source security data, the lack of standardized mapping of attack semantics, the reliance on human experience in rule construction, the difficulty in detecting complex attack behaviors through multi-entity constraints, and the lack of closed-loop verification of rule effectiveness. This invention provides a simulation method, system, storage medium, and device for generating and detecting attack rules for power monitoring systems based on ATT&CK mapping. This enables those skilled in the art to automatically construct, detect, execute, and continuously optimize attack rules for power monitoring systems based on clear data patterns, behavior templates, mapping rules, constraint logic, rule expression methods, simulation interfaces, and implementation process flows.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping, comprising the following steps:

[0007] First, multi-source security data is collected from the power monitoring system. This multi-source security data includes at least network traffic data, host audit data, identity authentication data, industrial control protocol session data, boundary security device alarm data, asset ledger data, topology relationship data, and business operation record data. The data from different sources are then encapsulated into structured events according to a unified event model. The unified event model includes at least the following fields: timestamp, event type, source object identifier, target object identifier, protocol type, port information, account information, process information, file characteristics, object role, region, business scenario tag, evidence source, and event confidence level.

[0008] Based on this, structured events are parsed, aggregated, and standardized, and basic behavioral instances such as network access, address scanning, port scanning, password guessing, vulnerability exploitation, process startup, file dumping, remote command execution, lateral propagation, and mobile media access are extracted. Basic behavioral templates are formed based on objects, actions, parameters, time windows, roles, and scenarios.

[0009] Subsequently, an ATT&CK mapping rule base for power monitoring systems is constructed. This ATT&CK mapping rule base takes basic behavior types, object roles, protocol semantics, business scenario tags, and evidence integrity as input, and outputs ATT&CK tactical layer tags, technical layer tags, and mapping confidence scores. Specifically, the ATT&CK technical tags are first screened in the first round according to basic behavior types, then screened in the second round according to object roles and power scenario tags, and then the mapping confidence scores of the candidate tags are calculated according to protocol semantics, business context, and evidence integrity. For multiple candidate tags whose mapping confidence score difference is less than a preset threshold, the main tag and candidate tags are retained and conflict resolution is performed in the subsequent rule generation stage. For behaviors with mapping confidence scores lower than the preset threshold, they are only retained as candidate behaviors and are not directly triggered to generate composite rules.

[0010] After obtaining candidate attack semantic units with ATT&CK semantics, attack rule expressions are automatically generated based on the attack phase template. The automatic generation process includes: filtering candidate behavior sets that match the current scenario tags; generating behavior sequence skeletons according to the preset attack phase template; injecting object consistency constraints and reachability constraints according to the object relationship diagram between the main station, plant station, dispatch data network, remote terminal and boundary protection equipment; generating role attribute constraints, protocol semantic constraints and business parameter constraints according to object roles and protocol types; finally, performing conflict merging, redundancy removal and priority assignment on the candidate rules to generate the target attack rule expression. The attack rule expression consists of behavior expression items, logical operation items and constraint items. The logical operation items include at least one or more of AND, OR, NOT, sequential relationship and repetition relationship. The constraint items include at least time window constraints, object consistency constraints, role attribute constraints, scenario constraints and protocol semantic constraints.

[0011] Furthermore, the attack rule expression is loaded into the rule matching engine to perform multi-entity association detection on real-time or offline security data. The multi-entity association detection includes: establishing a candidate behavior index; binding behaviors with the same source object, target object, account, session link, or adjacent reachable path relationship to objects; performing time window determination and protocol semantic verification on the binding results; aggregating behavioral evidence that satisfies the attack rule expression into an attack evidence set; determining the risk level based on the number of hit rules, mapping confidence, evidence completeness, and key object weights; and outputting the attack type, ATT&CK tags, attack stage, affected objects, and handling recommendations.

[0012] To verify the effectiveness of the rules, the generated rules are further deployed in a simulation verification environment. The simulation verification environment includes a master station-side server node, a plant-side monitoring node, a scheduling data network communication link, a remote terminal, an engineering station, an operation and maintenance access channel, and one or more of the following: a boundary firewall, a vertical encryption authentication device, or an isolation device. It supports one or more of the following communication protocols: IEC60870-5-104, IEC61850, Modbus / TCP, SSAL, or SSL. It also supports orchestration of near-source penetration cross-border attack scenarios, attack replay, high-concurrency session injection, and behavior simulation. By replaying, simulating, or reproducing typical attack scenarios such as port scanning, password guessing, vulnerability exploitation, remote command execution, cross-regional abnormal access, and lateral propagation, the rule hit rate, false alarm rate, false negative rate, trigger latency, and object adaptability are obtained.

[0013] Finally, based on the detection results and simulation verification results, the ATT&CK mapping rules, time window parameters, object relationship constraints, role attribute constraints, protocol semantic constraints, rule priorities, and risk thresholds are corrected and updated to form a closed loop of rule generation, rule detection, simulation verification, and feedback optimization.

[0014] Compared with existing technologies, the beneficial effects of this invention are: this invention does not simply superimpose the ATT&CK framework and rule engine, but rather provides unified constraints on the specificity of the object hierarchy, protocol type, and business link of the power monitoring system.

[0015] Firstly, a unified event pattern and behavior template are exposed in the data representation layer, enabling heterogeneous events from the main station, plant, and boundary protection equipment to be described in a unified manner.

[0016] Secondly, the semantic mapping layer exposes the mapping method between basic behaviors and ATT&CK tactics, techniques and power scenario tags, which improves the consistency and interpretability of attack analysis;

[0017] Thirdly, the rule generation layer exposes the combination methods of multi-dimensional constraints such as logic, time, object, role and protocol, enabling complex attack rules to be generated automatically rather than relying on manual static maintenance;

[0018] Fourthly, a simulation verification and parameter feedback mechanism is introduced at the engineering application layer, so that the rules can be evaluated in a closed loop and continuously optimized before they are officially put into use. Attached Figure Description

[0019] The accompanying drawings, as part of this invention, are provided to further illustrate the invention. The illustrative embodiments and descriptions of the invention are used to explain the invention, but do not constitute an undue limitation thereof. Clearly, the drawings described below are merely some embodiments, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0020] Figure 1 This is the overall flowchart of the present invention, showing the data flow and calling relationships between multi-source security data acquisition, behavior extraction and standardization, ATT&CK mapping, rule generation, matching detection, simulation verification and rule updating;

[0021] Figure 2 A schematic diagram for modeling unified event patterns and object relationships in power monitoring systems, illustrating the normalization process of objects such as master stations, substations, dispatch data networks, remote terminals, and boundary protection equipment, as well as their events;

[0022] Figure 3This diagram shows the mapping relationship between basic behaviors and ATT&CK's tactical, technical, and scenario labels, illustrating the mapping paths for behaviors such as scanning, password guessing, vulnerability exploitation, remote command execution, and lateral propagation.

[0023] Figure 4 Automatically generate structure diagrams for attack rule expressions, showing the combination of behavioral expression items, logical operation items, and constraint items such as time windows, objects, roles, scenarios, and protocols;

[0024] Figure 5 This is a flowchart for multi-entity association detection based on attack rules, illustrating the process of candidate behavior selection, object binding, time determination, evidence aggregation, and result output.

[0025] Figure 6 This is a schematic diagram of the electronic device used in the present invention, which is based on the ATT&CK mapping-based method for generating and detecting attack rules in a power monitoring system. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. It should be understood that the various steps described in the method embodiments of the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0027] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, any variations of the terms "comprising" and "having," etc., are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0030] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0031] The following description, using a typical scenario comprising a power monitoring system master station, substation, dispatch data network, remote terminal unit (RTU), and boundary protection equipment, further illustrates the technical solution of this invention. It should be noted that the following parameter values, field settings, and threshold ranges are used to demonstrate that this invention can be implemented and do not constitute the sole limitation on the scope of protection of this invention. Those skilled in the art can make equivalent substitutions without departing from the concept of this invention.

[0032] like Figure 1-5 As shown, a simulation method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping includes the following steps:

[0033] S1, Multi-source secure data acquisition and unified event mode

[0034] 1. Data Collection Objects and Data Types

[0035] In a preferred embodiment, the main station side data collection objects include: SCADA / EMS server, historical database server, engineer station, dispatcher workstation, vertical encryption authentication device, firewall, switch and bastion host; the plant / site side data collection objects include: station control server, RTU, IED, boundary firewall, horizontal isolation device, vertical encryption authentication device, operation and maintenance terminal and mirror probe; the dispatch data network side data collection objects include communication link, boundary routing equipment and access switching equipment.

[0036] The collected data includes at least: network traffic obtained through mirroring ports, TAP devices, or virtual switch mirroring; host audit and authentication logs obtained through Syslog, SNMPv3, host agent, and database audit interfaces; IEC60870-5-104, IEC61850, Modbus / TCP, and other maintenance protocol sessions obtained through industrial control protocol parsers; access control, abnormal access, session blocking, and threat alarms obtained through boundary security devices; and asset ledgers, account relationships, and network topology information.

[0037] 2. Unified event field structure

[0038] Perform timestamp alignment, field mapping, object normalization, and deduplication on raw records from different data sources to generate a unified event E.

[0039]

[0040]

[0041] Where ts represents timestamp, etype represents event type, src and dst represent source object and target object respectively, protocol represents protocol type, port represents port or service identifier, account represents account identifier, process represents process name or service name, file_hash represents file fingerprint, role represents object role, zone represents security zone, scene represents power business scenario label, source represents evidence source, and confidence represents event confidence.

[0042] 3. Object-Relational Modeling

[0043] To support subsequent object consistency constraints and reachability path determination, an object relationship graph G=(V,E_g) is constructed, where V represents the set of objects, and E_g represents the connection relationships, login relationships, control relationships, alarm association relationships, or topological membership relationships between objects. The object relationship graph must at least maintain the vertical connection relationships from the master station to the plant, the horizontal connection relationships within the station control layer, the login relationships from the operation and maintenance terminal to the controlled devices, and the filtering relationships of the boundary security devices.

[0044] S2. Basic Behavior Extraction and Standardized Representation

[0045] 1. Behavior Template Definition

[0046]

[0047] Here, obj represents the behavior object, action represents the behavior action, param represents the behavior parameter, role represents the object role, window represents the time window, scene represents the scene label, and evidence represents the underlying evidence list corresponding to the behavior.

[0048] 2. Typical Basic Behavior Extraction Rules

[0049] Address scanning behavior ipscan: Within a 60-second time window, if the same source object accesses at least 15 different target addresses, and the target object role belongs to at least one of the following: server, master device, or border device, it is extracted as address scanning behavior.

[0050] Port scanning behavior: If, within a 60-second time window, the same source object accesses the same target object at least 40 different ports, it is extracted as port scanning behavior.

[0051] Password guessing behavior (pwdguess): If at least 10 authentication failures occur within a 60-second time window for the same account or terminal, and the failure targets are the main station server, factory monitoring host, or border device, it is extracted as password guessing behavior.

[0052] Remote command execution related behavior remotetecmdexec: If the same object or related object starts a suspicious process, interpreter or command line tool within a time window of 5s to 20s after an abnormal network connection or maintenance session occurs, it constitutes remote command execution related behavior.

[0053] Lateral movement behavior: When a new abnormal login session, file copy session or remote service call relationship is established between a known controlled object and another object, and the object reachable path exists, it is extracted as a lateral movement behavior.

[0054] 3. Binding of behavioral evidence

[0055] Each basic behavior instance is generated by saving the corresponding evidence event number, evidence time interval and evidence source type, so that subsequent rule hit results can be traced back to the underlying network traffic, host logs, authentication logs or boundary alarms.

[0056] S3 and ATT&CK mapping rule base construction

[0057] 1. Definition of Mapping Unit

[0058]

[0059] in, This indicates the ATT&CK tactical tag. This indicates the ATT&CK technology label. Indicates a power business scenario label, c This represents the mapping confidence level.

[0060] 2. Scene Division Method

[0061] In a preferred embodiment, the power monitoring system is divided into the main station operation and maintenance access scenario, the plant boundary access scenario, the station control layer horizontal communication scenario, the dispatch data network communication scenario, the remote control execution scenario, and the remote terminal maintenance scenario. The same basic behavior can be mapped to different ATT&CK technology tags in different scenarios. For example, abnormal port scanning is preferentially mapped to reconnaissance or discovery technology in the main station operation and maintenance access scenario, while initial access technology is also considered in the plant boundary access scenario.

[0062] 3. Calculation of mapping confidence

[0063] In a preferred embodiment of the present invention, the ATT&CK mapping is not a single static mapping of basic behaviors, but rather adopts a hierarchical mapping mechanism of "candidate screening - confidence calculation - conflict resolution". First, a first round of candidate screening is performed on ATT&CK technology tags based on the type of basic behavior. For example, address scanning and port scanning are preferentially associated with reconnaissance or discovery technology tags, password guessing is preferentially associated with credential access technology tags, and vulnerability exploitation and remote command execution are preferentially associated with initial access, execution, or privilege escalation technology tags. Second, a second round of screening is performed based on the role, region, and business scenario tags of the object to which the behavior occurs. For example, abnormal port scanning is preferentially mapped to reconnaissance or discovery technologies in the main station maintenance access scenario, while initial access candidate technology tags are retained in the factory boundary access scenario. Third, the mapping confidence of each candidate tag is calculated based on protocol semantics, business context, and evidence integrity, preferably in the following form:

[0064]

[0065] in, Indicates the degree of matching of behavior type. fp represents the object role matching degree, and fp represents the protocol semantic matching degree. Indicates the scene tag matching degree. These are the weighting coefficients, and When the difference in mapping confidence among multiple candidate labels is less than a preset threshold, the main label and candidate labels are retained and enter the subsequent rule generation stage, and the conflict is further resolved by combining the behavior combination relationship; when the mapping confidence is lower than the preset threshold, only the basic behavior is retained as a candidate behavior and the compound rule generation is not directly triggered.

[0066] S4. Automatic generation of attack rule expressions

[0067] 1. General formula for expressing rules

[0068]

[0069] in, To express the logical combination relationship between basic behaviors, one or more of the following can be used: "AND", "OR", "sequential order", and "repetition". Indicates time window constraints. Represents object consistency constraints. This indicates character attribute constraints. Indicates scenario constraints. This indicates the protocol semantics and business parameter constraints.

[0070] 2. Rule Template Generation Process

[0071] The rule generator first determines the basic behavior types and their order of combination based on the scenario template. Then, it introduces object constraints such as the same source object, the same target object, the same account, the same session chain, or adjacent reachable paths based on the object relationship diagram. Subsequently, it adds role restrictions such as master station, power plant, boundary equipment, and remote terminal based on the object roles and power scenario. Finally, it overlays protocol and business parameter restrictions to generate complete rules.

[0072] In a preferred embodiment of the present invention, the automatic attack rule generation process includes at least the following sub-steps:

[0073] S41, Filter the set of candidate behaviors that match the current master station, plant, dispatch data network, remote terminal or boundary access scenario from the ATT&CK mapping rule base;

[0074] S42, Generate a behavior sequence skeleton according to a preset attack phase template, wherein the attack phase template includes at least one or more of the reconnaissance, initial access, execution, lateral movement and influence phases;

[0075] S43, inject object consistency constraints and reachability constraints into the behavior sequence skeleton according to the object relationship diagram. The object relationship diagram at least describes the connection relationship, subordinate relationship and adjacent reachability relationship between the master station side server, the plant side monitoring host, the remote terminal, the engineering station, the boundary protection equipment and the scheduling data network equipment.

[0076] S44, Generate role attribute constraints, protocol semantic constraints and business parameter constraints according to object role and protocol type, wherein the protocol semantic constraints include at least the session direction, function code, link role or session state in IEC60870-5-104, IEC61850, Modbus / TCP, SSAL or SSL protocol.

[0077] S45, perform conflict merging, priority assignment, and redundancy removal on the candidate attack rule expressions. Priority assignment considers at least scenario criticality, mapping confidence, historical hit rate, and evidence integrity. Through these sub-steps, multiple discrete basic behaviors within the same scenario can be automatically combined into composite attack rules with logical constraints and contextual semantics.

[0078] 3. Typical examples of compound rules

[0079]

[0080] In the formula, This indicates abnormal network session behavior. This indicates suspicious process initiation behavior. This indicates that there is a parent-child chain association between the session object and the process object, such as the same host, the same account, or the same process. This indicates that the target role belongs to one of the following: server, monitoring host, engineering station, or edge device. When all of the above conditions are met, it is judged as a "vulnerability exploitation-remote command execution" combined attack.

[0081] For scanning rules, they can be automatically generated in the form of "single action + time window + role constraint"; for multi-stage attack rules, they can be automatically generated in the form of a stage chain template of "access - detection - exploitation - execution - diffusion".

[0082] S5. Multi-entity association detection and result output

[0083] 1. Rule matching execution order

[0084] In a preferred embodiment of the present invention, multi-entity association detection is performed by a rule matching engine, including at least the following steps: First, a candidate behavior index is established based on behavior type, scene label, and rule priority; second, behaviors with the same source object, same target object, same account, same session link, or adjacent reachable path relationship are bound to objects; third, time window judgment and protocol semantic verification are performed on the binding results to eliminate candidate behaviors whose time span exceeds the preset window or whose protocol context is inconsistent; subsequently, behaviors that satisfy the attack rule expression are aggregated into an attack evidence set, and the evidence time, evidence source, evidence object, and evidence association relationship are recorded; then, a risk score is calculated based on the number of hit rules, mapping confidence, evidence completeness, and key object weight; finally, the detection results are divided into high-risk, medium-risk, and low-risk levels according to the risk score, and the attack type, ATT&CK label, attack stage, affected object, evidence summary, and suggested handling action are output; compared with single-point log detection, the present invention can establish cross-object, cross-protocol, and cross-time window evidence associations between the main station, plant station, scheduling data network, and boundary access object, improving the consistency and accuracy of composite attack identification.

[0085] 2. Hit Result Structure

[0086] The hit result should include at least the rule number, rule name, ATT&CK tactical tag, ATT&CK technical tag, scenario tag, hit time, source object, target object, set of evidence event numbers, risk level, and suggested action. The hit result can be sent to the alarm center or used as input for simulation evaluation and action scheduling.

[0087] 3. Risk Classification

[0088] In a preferred embodiment, the hit results can be risk-scored based on rule confidence, evidence completeness, target object criticality, and type of business impact, and divided into three levels of risk: high, medium, and low, to assist in subsequent handling.

[0089] S6-7, Simulation Verification and Rule Update Closed Loop

[0090] 1. Components of the simulation environment

[0091] In a preferred embodiment of the present invention, the simulation verification environment adopts a hierarchical structure of master station-plant station-dispatch data network, including at least a master station-side dispatch server, an engineer station, a plant station-side monitoring host, a remote terminal unit, a vertical encryption authentication device, a boundary firewall, an isolation device, and a dispatch data network communication link, supporting one or more protocol session simulations of IEC60870-5-104, IEC61850, Modbus / TCP, SSAL, and SSL; preferably, the simulation environment adopts a combination of lightweight virtualization and protocol semantic reconstruction, supporting near-source penetration cross-border attack scenario orchestration, high-concurrency session injection, scenario replay, and attack simulation.

[0092] 2. Scene orchestration and verification metrics

[0093] The scenario orchestration module executes attack scenarios such as address scanning, port scanning, password guessing, vulnerability exploitation, remote command execution, lateral propagation, cross-regional abnormal access, and mobile media propagation based on attack templates, and records indicators such as rule hit rate, false alarm rate, average trigger latency, object adaptability, and evidence integrity.

[0094] 3. Feedback and Update Mechanism

[0095] When a rule generates false positives in a specific scenario, object consistency constraints and role attribute constraints are checked first. When false negatives occur, behavior thresholds, time window parameters, and mapping confidence thresholds are checked first. When new attack patterns emerge, new basic behaviors and scenario templates are added to the mapping rule base, and corresponding rules are regenerated. When the false positive rate exceeds a preset threshold, the rule trigger threshold is increased or object consistency constraints are tightened. When the false negative rate exceeds a preset threshold, the mapping confidence threshold is decreased or scenario constraints are relaxed. When the trigger latency exceeds a preset threshold, the candidate behavior window is reduced or the indexing strategy is adjusted. Based on the update results, version management is implemented for the ATT&CK mapping rule base and attack rule base to form a continuous optimization closed loop. This simulation verification and update mechanism is consistent with the main station-plant level high-precision simulation, near-source penetration cross-boundary attack simulation, and protocol support directions such as IEC60870-5-104 and SSAL proposed in the task book.

[0096] Complete Implementation

[0097] 1. Implementation Environment

[0098] This embodiment adopts a typical power monitoring system environment consisting of a provincial dispatch master station, a 220kV substation, a dispatch data network, and boundary protection devices. The master station side includes a SCADA / EMS server, a historical database server, an engineering workstation, a firewall, and a vertical encryption authentication device; the substation side includes a station control server, an RTU, an IED, a boundary firewall, a horizontal isolation device, and an operation and maintenance terminal; the dispatch data network provides a vertical communication link between the master station and the substation.

[0099] 2. Attack Scenario

[0100] At time t0, the plant maintenance terminal experienced a short period of consecutive authentication failures; within t0+25s, the same source object initiated probes on multiple service ports of the station control server; subsequently, within t0+43s, the station control server established an abnormal maintenance session; at t0+49s, a suspicious command line interpreter process started on the same object.

[0101] 3. Rule generation and detection process

[0102] The system first extracts password guessing behavior (pwdguess) from authentication logs, port scanning behavior (portscan) from network traffic, and abnormal network session behavior (B_net(n)) and suspicious process startup behavior (B_prostart(p)) from maintenance session and process audit logs. Then, the mapping rule base maps pwdguess to credential access or initial access related technologies, portscan to reconnaissance or discovery related technologies, and the combination of B_net(n) and B_prostart(p) to execution related technologies. The rule generator automatically forms multi-stage rules for "password guessing—port scanning—remote command execution," and confirms through an object binding table that all three stages are triggered by the same maintenance terminal or its associated session chain.

[0103] 4. Test Results

[0104] During the detection and execution phase, the system hit the aforementioned multi-stage rules, outputting the rule number, hit time, maintenance terminal object, station control server object, evidence event set, ATT&CK tags, and high-risk handling suggestions. Manual verification revealed that the underlying evidence chain includes authentication failure records, port access records, maintenance session establishment records, and command-line process startup records, demonstrating that the generated rules can effectively identify typical composite attack behaviors.

[0105] 5. Simulation Verification and Update

[0106] After deploying the rules to the simulation environment, repeat the same scenario 20 times. If some rounds fail due to short maintenance session duration, the remote command execution time window is increased from 8 seconds to 12 seconds; if some rounds falsely report errors within the normal maintenance window, an "authorized maintenance time period exemption" scenario constraint is added. The updated rules are then rewritten to the rule base and verified again.

[0107] A system for implementing a simulation method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping, comprising:

[0108] The data acquisition module is used to collect and encapsulate multi-source security data from the power monitoring system.

[0109] The behavior extraction and standardization module is used to extract basic behavior instances and perform a unified representation.

[0110] The ATT&CK mapping module is used to establish the mapping relationship between basic behaviors and ATT&CK tactical layer, technical layer and power scenario labels and to calculate the mapping confidence.

[0111] The rule generation module is used to automatically generate attack rule expressions and perform conflict merging, redundancy removal, and priority assignment.

[0112] The association detection module is used to perform multi-entity association detection on real-time or offline security data; the simulation verification module is used to replay, deduce, and evaluate the generated rules.

[0113] The feedback update module is used to correct and update the mapping rules and attack rules based on the detection and verification results;

[0114] The modules exchange data and call functions through standardized interfaces and message buses to form a complete power monitoring system attack rule generation and detection simulation system.

[0115] like Figure 6 The diagram illustrates the structure of an electronic device that can be used to implement embodiments of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0116] like Figure 6 As shown, the electronic device includes at least one processor and a memory, such as a read-only memory (ROM) or a random access memory (RAM), communicatively connected to the at least one processor. The memory stores computer programs executable by the at least one processor. The processor can perform various appropriate actions and processes based on the computer programs stored in the ROM or loaded from memory cells into the RAM. The RAM can also store various programs and data required for the operation of the electronic device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0117] Multiple components in an electronic device are connected to an I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0118] Processors can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processors include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processors execute the various methods and processes described above, such as the simulation method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping.

[0119] In some embodiments, the ATT&CK-based power monitoring system attack rule generation and detection simulation method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by a processor, one or more steps of the ATT&CK-based power monitoring system attack rule generation and detection simulation method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the ATT&CK-based power monitoring system attack rule generation and detection simulation method by any other suitable means (e.g., by means of firmware).

[0120] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0122] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0124] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0125] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0126] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A simulation method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping, characterized in that, The method, applied to a power monitoring system comprising a master station, substations, dispatch data network, remote terminal units (RTUs), and boundary protection equipment, includes the following steps: S1. Collect multi-source security data from the power monitoring system and convert the multi-source security data into structured events according to a unified event model; S2. Parse, aggregate, and standardize the structured events to extract basic behavior instances; S3. Construct an ATT&CK mapping rule base based on basic behavior type, object role, protocol semantics and power scene tags, and use the ATT&CK mapping rule base to map the basic behavior instances to tactical layer tags, technical layer tags and scene tags to obtain candidate attack semantic units with mapping confidence. S4. Based on candidate attack semantic units, behavior phase templates, object relationship constraints, role attribute constraints, time window constraints, and protocol semantic constraints, automatically generate attack rule expressions, and perform conflict merging, redundancy removal, and priority assignment on the generated attack rule expressions; S5. Load the attack rule expression into the rule matching engine, perform multi-entity association detection on real-time or offline security data, complete candidate behavior indexing, object binding, time determination, protocol verification and evidence aggregation, and output attack type, hit evidence, ATT&CK label, risk level, attack stage and affected objects; S6. Deploy the attack rule expression to the simulation verification environment, and perform playback, deduction or reproduction of typical attack behaviors based on the main station-plant station-schedule data network scenario to obtain the rule hit rate, false alarm rate, false alarm rate, trigger latency and object adaptability. S7. Based on the detection results and simulation verification results, the ATT&CK mapping rules, time window parameters, object relationship constraints, role attribute constraints, protocol semantic constraints, rule priorities and risk thresholds are corrected and updated to form a closed loop of rule generation, rule detection, simulation verification and feedback optimization.

2. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 1, characterized in that, The multi-source security data in step S1 includes at least: network traffic data, host audit data, identity authentication data, industrial control protocol session data, boundary security device alarm data, asset ledger data, topology relationship data, and business operation record data; The industrial control protocol session data includes one or more of the following protocols: IEC60870-5-104, IEC61850, Modbus / TCP, SSAL, or SSL. The unified event mode includes at least the following fields: timestamp, event type, source object identifier, target object identifier, protocol type, port information, account information, process information, file characteristics, object role, region, business scenario tag, evidence source, and event confidence level. Among them, the source object and target object at least cover one or more of the following: master station server, plant monitoring host, scheduling data network equipment, RTU / IED, engineer station, operation and maintenance terminal, firewall, isolation device, and vertical encryption authentication device.

3. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 1 or 2, characterized in that, The basic behavior instances in step S2 are represented using a unified behavior template, which is expressed as follows: Wherein, obj represents the behavior object, action represents the behavior action, param represents the behavior parameter, role represents the object role, window represents the time window, scene represents the power business scenario, and evidence represents the underlying evidence set corresponding to the behavior; and, in step S2, a combination of time window aggregation, threshold judgment and pattern matching is used to extract behavior. Among them, address scanning behavior is satisfied that the same source object accesses at least 15 different target addresses within 60 seconds, port scanning behavior is satisfied that the same source object accesses at least 40 different ports of the same target object within 60 seconds, and password guessing behavior is satisfied that the same account or the same terminal fails authentication at least 10 times within 60 seconds.

4. A method for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping, as described in claim 1 or 3, characterized in that... The mapping rule base in step S3 is organized using a six-element relationship: "Basic Behavior Type—Power Object Role—Scenario Label—ATT&CK Tactical Label—ATT&CK Technical Label—Confidence Level". The power object roles include at least: master station server, plant / station monitoring host, dispatch data network equipment, boundary security equipment, and remote terminal unit (RTU). The scenario labels include at least: master station maintenance access scenario, plant / station boundary access scenario, station control layer horizontal communication scenario, dispatch data network communication scenario, and remote control scenario. The mapping result is represented as follows:

5. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 4, characterized in that, Step S3 includes: S31, conduct the first round of candidate screening for ATT&CK technical tags based on basic behavior types; S32, the candidate ATT&CK technology tags are screened in the second round according to the object role and power scenario tags; S33, calculate the mapping confidence of each candidate ATT&CK technology label according to protocol semantics, business context and evidence integrity; S34, when the difference in mapping confidence of multiple candidate ATT&CK technical labels is less than a preset threshold, both the main label and the candidate labels are retained, and conflict resolution is carried out in the subsequent rule generation stage by combining the behavior combination relationship. S35, when the mapping confidence is lower than the preset threshold, only the corresponding basic behavior instance is retained as a candidate behavior and the compound rule generation is not directly triggered.

6. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 1, characterized in that, The attack rule expression in step S4 consists of behavioral expression terms, logical combination terms, and constraint terms, and the general rule formula is as follows: in, This indicates the logical combination relationship between basic behaviors. Indicates time window constraints. Represents object consistency constraints. This indicates character attribute constraints. Indicates scenario constraints. It represents the protocol semantics and business parameter constraints; and, for the "vulnerability exploitation - remote command execution" composite scenario, the rule expression satisfies that abnormal network session behavior and suspicious process startup behavior occur within a preset time window, and that the session object and the process object are associated.

7. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 6, characterized in that, Step S4 includes: S41, Filter the set of candidate behaviors that match the current scene label from the ATT&CK mapping rule base; S42, Generate a behavior sequence skeleton based on a preset attack phase template; S43, inject object consistency constraints and reachability constraints based on the object relationship diagram between the master station, plant station, remote terminal, boundary protection equipment and dispatch data network equipment; S44, Generate role attribute constraints, protocol semantic constraints, and business parameter constraints based on object roles and protocol types; S45 performs conflict merging, priority assignment, and redundancy removal on the candidate attack rule expressions to obtain the target attack rule expression.

8. A method for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping, as described in claim 6 or 7, is characterized in that... The object consistency constraint in step S4 includes at least one or more of the following: same source object, same target object, same account, same session chain, or reachable path adjacency relationship; the time window constraint is calculated using a sliding window method, with a preferred time window of 30s to 120s for scanning behavior, a preferred time window of 30s to 90s for password guessing behavior, and a preferred time window of 5s to 20s for remote command execution related behavior; the attack rule expression consists of behavior expression terms, logical operation terms, and constraint terms, wherein the logical operation terms include at least one or more of the following: AND, OR, NOT, sequential relationship, and recurrence relationship; the constraint terms include at least time window constraint, object consistency constraint, role attribute constraint, scenario constraint, and protocol semantic constraint.

9. The method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping according to claim 1, characterized in that, The multi-entity association detection in step S5 includes: establishing a candidate behavior index; binding behaviors with the same source object, the same target object, the same account, the same session link, or adjacent reachable paths to objects; performing time window judgment and protocol semantic verification on the binding results; aggregating behavioral evidence that satisfies the attack rule expression into an attack evidence set; determining the risk level based on the number of hit rules, mapping confidence, evidence completeness, and key object weights; and outputting the attack type, attack stage, ATT&CK label, affected objects, and handling suggestions.

10. A method for generating and detecting attack rules in a power monitoring system based on ATT&CK mapping, as described in claim 1 or 9, characterized in that... The simulation verification environment in step S6 includes: a main station-side server node, a plant-side monitoring node, a scheduling data network communication link, a remote terminal, an engineering station, an operation and maintenance access channel, and one or more of the following: a boundary firewall, a vertical encryption authentication device, or an isolation device; the simulation verification environment supports one or more of the following communication protocols: IEC60870-5-104, IEC61850, Modbus / TCP, SSAL, or SSL, and supports orchestration of near-source penetration cross-border attack scenarios, attack replay, and high-concurrency session injection.

11. A method for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping, as described in claim 1 or 10, characterized in that... The feedback update in step S7 includes: when the false positive rate is higher than the preset threshold, increasing the rule trigger threshold or tightening the object consistency constraint; when the false negative rate is higher than the preset threshold, decreasing the mapping confidence threshold or relaxing the scenario constraint; when the trigger latency is higher than the preset threshold, reducing the candidate behavior window or adjusting the indexing strategy; and performing version management on the ATT&CK mapping rule base and attack rule base according to the update results.

12. A simulation system for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping, implementing the method of any one of claims 1 to 11, characterized in that, include: The data acquisition module is used to collect and encapsulate multi-source security data from the power monitoring system. The behavior extraction and standardization module is used to extract basic behavior instances and perform a unified representation. The ATT&CK mapping module is used to establish the mapping relationship between basic behaviors and ATT&CK tactical layer, technical layer and power scenario labels and to calculate the mapping confidence. The rule generation module is used to automatically generate attack rule expressions and perform conflict merging, redundancy removal, and priority assignment. The association detection module is used to perform multi-entity association detection on real-time or offline security data; the simulation verification module is used to replay, deduce, and evaluate the generated rules. The feedback update module is used to correct and update the mapping rules and attack rules based on the detection and verification results; The modules exchange data and call functions through standardized interfaces and message buses to form a complete power monitoring system attack rule generation and detection simulation system.

13. An electronic device, characterized in that, The device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the simulation method for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping as described in claim 1.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the method for generating and detecting attack rules for a power monitoring system based on ATT&CK mapping as described in claim 1.

Images