An industrial control vulnerability hazard assessment method, device, equipment, medium and program product

Abstract

The application provides an industrial control vulnerability hazard evaluation method, device, equipment, medium and program product, relates to the technical field of data, improves the accuracy of the industrial control vulnerability hazard evaluation result, and the specific technical scheme is: based on the multi-source heterogeneous data of the industrial control system, a heterogeneous graph containing vulnerability nodes, network asset nodes and physical entity nodes is constructed; based on the heterogeneous graph, the direct connection damage element path and the cascade transmission element path are used to extract the cascade hazard conduction path of the vulnerability among the vulnerability nodes, the network asset nodes and the physical entity nodes; based on the cascade hazard conduction path, the node embedding vector fusing the direct physical hazard and the indirect cascade hazard is generated; based on the node embedding vector, the multi-dimensional cascade hazard score is generated, and the cascade gain value and the hidden correlation influence factor are calculated based on the multi-dimensional cascade hazard score; based on the cascade gain value and the hidden correlation influence factor, the quantitative evaluation result of the industrial control vulnerability is output. Applied to the scene of industrial control vulnerability hazard evaluation.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus, equipment, medium, and program product for assessing the risks of industrial control system vulnerabilities. Background Technology

[0002] With the acceleration of the Industrial Internet and the digitalization of critical infrastructure, industrial control systems are evolving from closed and isolated dedicated networks into interconnected systems that deeply integrate the information and physical domains. In this evolution, the boundaries between information technology and operational technology are becoming increasingly blurred. The coexistence of massive industrial assets, complex control logic, and diverse network protocols has led to new characteristics of security threats in the network environment, including cross-domain cascading and physical consequences, posing new challenges to security assessment technologies in industrial environments.

[0003] In conventional industrial safety assessment practices, the system theory process analysis method breaks through the limitations of traditional reliability engineering, which only focuses on component failure. From a cybernetics perspective, it regards safety issues as constraint problems in the control structure. By constructing a hierarchical control structure model, it defines the feedback loops and interaction logic between sensors, controllers, actuators and the controlled process, and then analyzes the potential deviations in the transmission and execution of control commands, identifies unsafe control behaviors, and formulates safety constraint measures.

[0004] However, existing graph neural network models rely on network connections to associate nodes, treating industrial control equipment as homogeneous nodes. In hazard propagation analysis, current methods rely on static scoring of isolated vulnerabilities or qualitative logical deduction for evaluation. Regarding the interpretation of evaluation results, existing deep learning models output a single risk score as the evaluation outcome. This makes it difficult for existing evaluation mechanisms to accurately identify hidden threat sources, resulting in low accuracy of evaluation results. Summary of the Invention

[0005] This application provides a method, apparatus, equipment, medium, and program product for assessing industrial control system (ICS) vulnerabilities, which can improve the accuracy of ICS vulnerability assessment results.

[0006] In a first aspect, embodiments of this application provide a method for assessing the hazard of industrial control system vulnerabilities, the method comprising:

[0007] Based on multi-source heterogeneous data from industrial control systems, a heterogeneous graph is constructed that includes vulnerability nodes, network asset nodes, and physical entity nodes. The aforementioned multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data.

[0008] Based on the above heterogeneous graph, the cascading harm propagation path of the vulnerability is extracted between the above-mentioned vulnerability node, the above-mentioned network asset node and the above-mentioned physical entity node by using the direct-connection damage element path and the cascading propagation element path.

[0009] Based on the above cascading hazard propagation path, a node embedding vector that integrates direct physical hazards and indirect cascading hazards is generated.

[0010] Based on the above node embedding vectors, a multidimensional cascade hazard score is generated, and the cascade gain value and hidden correlation influence factor are calculated based on the above multidimensional cascade hazard score.

[0011] Based on the aforementioned cascaded gain values ​​and the aforementioned hidden correlation influence factors, the quantitative assessment results of industrial control system vulnerabilities are output.

[0012] The technical solution provided in this application brings at least the following beneficial effects: Based on multi-source heterogeneous data such as network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data from industrial control systems, a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes can be constructed. This clearly distinguishes the attribute differences and cross-domain relationships of different types of nodes. Furthermore, by utilizing direct-connection damage meta-paths and cascading propagation meta-paths, the complete cascading hazard propagation path of vulnerabilities among the three types of nodes can be extracted, fully covering the entire chain propagation process of vulnerabilities from the network layer to the physical layer. Then, based on the aforementioned cascading hazard propagation path, a node embedding vector integrating direct physical hazards and indirect cascading hazards is generated, and based on the aforementioned node embedding vector... A multi-dimensional cascaded hazard score is generated, and the cascade gain value and hidden correlation influence factor are calculated. The role and hidden correlation strength of different nodes in hazard transmission are quantified, so that the industrial control system security assessment platform can output quantitative assessment results of industrial control vulnerabilities that simultaneously cover explicit direct hazards and implicit cascaded hazards based on the above-mentioned cascade gain value and hidden correlation influence factor. Therefore, it avoids the problem of low accuracy of industrial control vulnerability hazard assessment results caused by existing graph neural network models that use network connection relationship as the only node association basis, treat industrial control equipment as homogeneous nodes, and conduct hazard transmission analysis based on static scoring or qualitative logical deduction of isolated vulnerabilities. Thus, it significantly improves the accuracy of industrial control vulnerability hazard assessment.

[0013] One possible implementation, after constructing a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on the aforementioned multi-source heterogeneous data, the above-mentioned industrial control system vulnerability hazard assessment method further includes:

[0014] Construct generalized physical value vectors for the physical entity nodes in the above heterogeneous graph;

[0015] Based on the aforementioned cascading hazard propagation path, a node embedding vector integrating direct physical hazards and indirect cascading hazards is generated, including:

[0016] By using an attention mechanism with dynamic value bias, a node embedding vector that integrates direct physical hazards and indirect cascade hazards is generated based on the aforementioned cascade hazard propagation path.

[0017] The aforementioned dynamic value bias term is determined based on the aforementioned generalized physical value vector.

[0018] Another possible implementation is that the generalized physical value vector mentioned above includes a security value component, a confidentiality value component, and an availability value component;

[0019] The industrial control system vulnerability hazard assessment method provided in this application embodiment also includes:

[0020] Based on the security integrity level of the aforementioned physical entity nodes and the preset weighting coefficient of the execution logic of the aforementioned physical entity nodes, the aforementioned security value components are determined.

[0021] Based on the matching results between the memory address mapping information of the aforementioned physical entity nodes and the preset sensitive parameter segments, the aforementioned confidential value components are determined.

[0022] Based on the betweenness centrality of the aforementioned physical entity nodes in the control logic graph, the aforementioned availability value components are determined.

[0023] Another possible implementation involves constructing a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on the aforementioned multi-source heterogeneous data, including:

[0024] The aforementioned vulnerability nodes, network asset nodes, and physical entity nodes are constructed based on the aforementioned multi-source heterogeneous data.

[0025] Extracting operational semantics and network connectivity information from industrial control network traffic data based on deep packet inspection algorithm;

[0026] Based on the above operational semantics, construct semantic edges between the above network asset nodes and the above physical entity nodes;

[0027] Based on the aforementioned network connection information, construct the communication edges between the aforementioned network asset nodes and the dependency edges between the aforementioned vulnerability nodes and the aforementioned network asset nodes;

[0028] The heterogeneous graph is constructed based on the aforementioned vulnerability nodes, network asset nodes, physical entity nodes, semantic edges, communication edges, and dependency edges.

[0029] The heterogeneous graph includes the direct-connection damage-causing meta-path and the cascaded transmission meta-path, which are composed of the vulnerability node, the network asset node, the physical entity node and the edge sequence and are used to define risk transmission rules. The edge sequence includes at least one of the semantic edge, the communication edge and the dependency edge.

[0030] Another possible implementation is that the semantic edges mentioned above include key control edges and sensitive read edges; the operational semantics mentioned above include write operation primitives and read operation primitives.

[0031] The above-mentioned construction of semantic edges between network asset nodes and physical entity nodes based on operational semantics includes:

[0032] If the semantics of the above operation are the primitives of the above write operation class and the security value component corresponding to the above physical entity node is higher than the preset threshold, then construct a critical control edge.

[0033] If the semantics of the above operation are primitives of the above read operation class and the confidential value component corresponding to the above physical entity node is higher than the preset threshold, then a sensitive read edge is constructed.

[0034] Another possible implementation is that the aforementioned direct-connection damage-causing meta-paths include security breach paths, confidentiality leakage paths, and business interruption paths; the aforementioned cascading transmission meta-paths include cross-domain penetration paths.

[0035] The aforementioned security breach path sequentially passes through vulnerability nodes, network asset nodes, and physical entity nodes. Vulnerability nodes and network asset nodes are connected by dependency edges, and network asset nodes and physical entity nodes are connected by semantic edges.

[0036] The aforementioned confidential information leakage path sequentially passes through the vulnerability node, the network asset node, and the physical entity node. The vulnerability node and the network asset node are connected through a dependency edge, and the network asset node and the physical entity node are connected through a sensitive read edge.

[0037] The aforementioned service interruption path passes through the vulnerability node, the first network asset node, and the second network asset node in sequence. The vulnerability node and the first network asset node are connected through a dependency edge, and the first network asset node and the second network asset node are connected through a communication edge.

[0038] The aforementioned cross-domain penetration path sequentially passes through the first vulnerable node, the first network asset node, the second network asset node, and the second vulnerable node. The first vulnerable node and the first network asset node are connected by a dependency edge, the first network asset node and the second network asset node are connected by a communication edge, and the second network asset node and the second vulnerable node are connected by a dependency edge.

[0039] Another possible implementation is that the aforementioned cascading transmission meta-path includes cross-domain penetration paths;

[0040] The above-mentioned extraction of the cascading harm propagation path of the vulnerability among the aforementioned vulnerable node, network asset node, and physical entity node, using direct-connection damage meta-paths and cascading propagation meta-paths, includes:

[0041] Based on the above heterogeneous graph, an adjacency tensor of a preset dimension is generated;

[0042] Extract the first channel slice corresponding to the above-mentioned dependent edge, the second channel slice corresponding to the above-mentioned key control edge, the third channel slice corresponding to the above-mentioned sensitive read edge, and the fourth channel slice corresponding to the above-mentioned communication edge from the above-mentioned adjacency tensor.

[0043] A path instance matrix of security breach paths is generated based on the first channel slice and the second channel slice mentioned above.

[0044] A path instance matrix of confidential leakage paths is generated based on the first channel slice and the third channel slice mentioned above.

[0045] A path instance matrix of service interruption paths is generated based on the first channel slice and the fourth channel slice mentioned above.

[0046] The path instance matrix of the service interruption path contained in the above direct connection damage path and the path instance matrix of the cross-domain penetration path generated by the transposed first channel slice.

[0047] Extract the unique node identifiers corresponding to the aforementioned vulnerability nodes, network asset nodes, and physical entity nodes from all path instance matrices, and construct a node connection order identifier sequence based on the aforementioned unique node identifiers.

[0048] The aforementioned cascading hazard propagation path is generated based on the node connection sequence identifier.

[0049] Another possible implementation involves using an attention mechanism with a dynamic value bias term to generate a node embedding vector that integrates direct physical hazards and indirect cascading hazards based on the aforementioned cascading hazard propagation path. This includes:

[0050] The dynamic value bias term is determined based on the generalized physical value vector of the adjacent nodes of any node in the above cascading hazard propagation path, where any node and the adjacent nodes are any one of the above vulnerability nodes, the above network asset nodes and the above physical entity nodes.

[0051] Calculate the basic attention score between any of the above nodes and their adjacent nodes;

[0052] The basic attention score is weighted and amplified based on the aforementioned dynamic value bias term.

[0053] Based on the weighted attention score, the projected features of the above adjacent nodes are weighted and aggregated to obtain the semantic embedding of security breach path, confidentiality leakage path, business interruption path, and cross-domain penetration path corresponding to any of the above nodes.

[0054] Semantic-level aggregation is performed on the semantic embeddings of the above-mentioned security breach path, confidentiality leakage path, and service interruption path to obtain direct connection path features.

[0055] Semantic-level aggregation is performed on the semantic embeddings of the above cross-domain penetration paths to obtain cascaded path features;

[0056] By using an adaptive cascaded gating unit, the cascaded path features and the direct path features are residually fused to generate the node embedding vector that fuses direct physical hazards and indirect cascaded hazards.

[0057] Another possible implementation is that the aforementioned multidimensional cascading hazard score includes a physical security cascading score, a confidentiality leakage cascading score, and a production interruption cascading score.

[0058] Another possible implementation involves calculating the cascade gain value and hidden correlation influence factor based on the aforementioned multidimensional cascade hazard score, including:

[0059] The above-mentioned cascade gain value is determined based on the first difference between the comprehensive cascaded hazard score after weighted fusion of multi-dimensional cascaded hazard scores and the original basic vulnerability score.

[0060] The hidden correlation influence factor is determined by the ratio of the second difference in the physical security cascade score recalculated after severing the correlation path between vulnerabilities to the actual physical security cascade score.

[0061] Secondly, this application provides an industrial control system vulnerability hazard assessment device, including: a first construction module, used to construct a heterogeneous map containing vulnerability nodes, network asset nodes and physical entity nodes based on multi-source heterogeneous data of the industrial control system, wherein the multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data and industrial control network traffic data;

[0062] The extraction module is used to extract the cascading harm propagation path of the vulnerability among the above-mentioned vulnerability node, the above-mentioned network asset node and the above-mentioned physical entity node based on the above-mentioned heterogeneous graph and by using the direct-connection harmful element path and the cascading propagation element path.

[0063] The generation module is used to generate node embedding vectors that integrate direct physical hazards and indirect cascading hazards based on the above-mentioned cascading hazard propagation path.

[0064] The calculation module is used to generate a multi-dimensional cascade hazard score based on the above node embedding vector, and to calculate the cascade gain value and hidden correlation influence factor based on the above multi-dimensional cascade hazard score;

[0065] The output module is used to output the quantitative assessment results of industrial control system vulnerabilities based on the above-mentioned cascaded gain values ​​and the above-mentioned hidden correlation influence factors.

[0066] In one possible implementation, the aforementioned industrial control system vulnerability hazard assessment device further includes a second construction module; the second construction module is used to construct a generalized physical value vector for the physical entity nodes in the aforementioned heterogeneous graph.

[0067] Specifically, the aforementioned generation module is used to generate a node embedding vector that integrates direct physical hazards and indirect cascade hazards based on the aforementioned cascade hazard propagation path through an attention mechanism with a dynamic value bias term; wherein, the aforementioned dynamic value bias term is determined based on the aforementioned generalized physical value vector.

[0068] Another possible implementation is that the generalized physical value vector includes a security value component, a confidentiality value component, and an availability value component; the industrial control system vulnerability hazard assessment device further includes a determination module; the determination module is used to determine the security value component based on the security integrity level of the physical entity node and the preset weighting coefficient of the execution logic of the physical entity node; determine the confidentiality value component based on the matching result of the memory address mapping information of the physical entity node and the preset sensitive parameter segment; and determine the availability value component based on the betweenness centrality of the physical entity node in the control logic graph.

[0069] Another possible implementation is that the first building module mentioned above is specifically used for:

[0070] Based on the aforementioned multi-source heterogeneous data, the aforementioned vulnerability nodes, network asset nodes, and physical entity nodes are constructed; operational semantics and network connection information of industrial control network traffic data are extracted based on deep packet inspection algorithms; semantic edges between the aforementioned network asset nodes and physical entity nodes are constructed based on the aforementioned operational semantics; communication edges between the aforementioned network asset nodes and dependency edges between the aforementioned vulnerability nodes and network asset nodes are constructed based on the aforementioned network connection information; the aforementioned heterogeneous graph is constructed based on the aforementioned vulnerability nodes, network asset nodes, physical entity nodes, semantic edges, communication edges, and dependency edges; wherein, the aforementioned heterogeneous graph includes the aforementioned direct-connection damage-causing meta-path and the aforementioned cascaded transmission meta-path, which are composed of the aforementioned vulnerability nodes, network asset nodes, physical entity nodes, and edge sequences and are used to define risk transmission rules, and the aforementioned edge sequences include at least one of the aforementioned semantic edges, communication edges, and dependency edges.

[0071] Another possible implementation is that the semantic edges mentioned above include key control edges and sensitive read edges; the operational semantics mentioned above include write operation primitives and read operation primitives; the first construction module is further used to construct key control edges when the operational semantics are the write operation primitives and the security value component corresponding to the physical entity node is higher than a preset threshold; and to construct sensitive read edges when the operational semantics are the read operation primitives and the confidentiality value component corresponding to the physical entity node is higher than a preset threshold.

[0072] Another possible implementation is that the aforementioned direct-connection damage-causing meta-paths include security breach paths, confidentiality leakage paths, and business interruption paths; the aforementioned cascading transmission meta-paths include cross-domain penetration paths.

[0073] The aforementioned security breach path sequentially passes through vulnerability nodes, network asset nodes, and physical entity nodes. Vulnerability nodes and network asset nodes are connected by dependency edges, and network asset nodes and physical entity nodes are connected by semantic edges.

[0074] The aforementioned confidential information leakage path sequentially passes through the vulnerability node, the network asset node, and the physical entity node. The vulnerability node and the network asset node are connected through a dependency edge, and the network asset node and the physical entity node are connected through a sensitive read edge.

[0075] The aforementioned service interruption path passes through the vulnerability node, the first network asset node, and the second network asset node in sequence. The vulnerability node and the first network asset node are connected through a dependency edge, and the first network asset node and the second network asset node are connected through a communication edge.

[0076] The aforementioned cross-domain penetration path sequentially passes through the first vulnerable node, the first network asset node, the second network asset node, and the second vulnerable node. The first vulnerable node and the first network asset node are connected by a dependency edge, the first network asset node and the second network asset node are connected by a communication edge, and the second network asset node and the second vulnerable node are connected by a dependency edge.

[0077] Another possible implementation is that the aforementioned cascading transmission meta-path includes cross-domain penetration paths;

[0078] The extraction module is specifically used for: generating an adjacency tensor of a preset dimension based on the heterogeneous graph; extracting the first channel slice corresponding to the dependent edge, the second channel slice corresponding to the critical control edge, the third channel slice corresponding to the sensitive read edge, and the fourth channel slice corresponding to the communication edge from the adjacency tensor; generating a path instance matrix of security breach paths based on the first channel slice and the second channel slice; generating a path instance matrix of confidentiality leakage paths based on the first channel slice and the third channel slice; generating a path instance matrix of service interruption paths based on the first channel slice and the fourth channel slice; generating a path instance matrix of cross-domain penetration paths based on the path instance matrix of the service interruption paths included in the direct-connection damage source path and the transposed first channel slice; extracting the unique node identifiers corresponding to the vulnerability nodes, network asset nodes, and physical entity nodes from all path instance matrices, and constructing a node connection order identifier sequence based on the unique node identifiers; and generating the cascading hazard propagation path based on the node connection order identifier sequence.

[0079] Another possible implementation involves the generation module specifically determining a dynamic value bias term based on the generalized physical value vectors of adjacent nodes of any node in the cascading hazard propagation path, where any node and adjacent nodes are any of the vulnerability nodes, network asset nodes, and physical entity nodes, respectively; calculating the basic attention score between any node and adjacent nodes; weighting and amplifying the basic attention score based on the dynamic value bias term; weighting and aggregating the projection features of adjacent nodes based on the weighted attention score to obtain the semantic embeddings of the security breach path, confidentiality leakage path, business interruption path, and cross-domain penetration path corresponding to any node; performing semantic-level aggregation on the semantic embeddings of the security breach path, confidentiality leakage path, and business interruption path to obtain direct path features; performing semantic-level aggregation on the semantic embeddings of the cross-domain penetration path to obtain cascading path features; and using an adaptive cascading gating unit, performing residual fusion of the cascading path features and the direct path features to generate the node embedding vector that fuses direct physical hazards and indirect cascading hazards.

[0080] Another possible implementation is that the aforementioned multidimensional cascading hazard score includes a physical security cascading score, a confidentiality leakage cascading score, and a production interruption cascading score.

[0081] Another possible implementation is that the above calculation module is specifically used to: determine the above cascading gain value based on the first difference between the comprehensive cascading hazard score after weighted fusion of multi-dimensional cascading hazard scores and the original basic vulnerability score; and determine the above hidden correlation influence factor based on the ratio of the second difference of the physical security cascading score recalculated after cutting off the correlation path between vulnerabilities to the above actual physical security cascading score.

[0082] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0083] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0084] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0085] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0086] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0087] Figure 1 A schematic diagram of the network architecture for an industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0088] Figure 2 A flowchart illustrating an industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0089] Figure 3 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0090] Figure 4 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0091] Figure 5 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0092] Figure 6A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0093] Figure 7 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0094] Figure 8 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0095] Figure 9 A flowchart illustrating another industrial control system vulnerability hazard assessment method provided in this application embodiment;

[0096] Figure 10 This application provides a schematic diagram of the structure of an industrial control system vulnerability assessment system;

[0097] Figure 11 This application provides a schematic diagram of the structure of a multi-source heterogeneous data input layer in an industrial control system vulnerability assessment system.

[0098] Figure 12 This application provides a schematic diagram of the core assessment engine in an industrial control system vulnerability hazard assessment system.

[0099] Figure 13 This application provides a schematic diagram of the structure of the quantitative assessment result output layer in an industrial control system vulnerability hazard assessment system;

[0100] Figure 14 A schematic diagram of the structure of an industrial control system vulnerability hazard assessment device provided in this application embodiment;

[0101] Figure 15 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0102] The following section will describe in detail the industrial control system vulnerability assessment method, apparatus, equipment, media, and program products provided in this application, with reference to the accompanying drawings.

[0103] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0104] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0105] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0106] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0107] The embodiments of this application provide a method, apparatus, equipment, medium, and program product for assessing industrial control system vulnerabilities, which can be applied to industrial control system vulnerability assessment scenarios.

[0108] In existing technologies, graph neural network models use network connections as the basis for node association, treating industrial control equipment as homogeneous nodes. Regarding hazard propagation analysis, existing methods rely on static scoring of isolated vulnerabilities or qualitative logical deduction for evaluation. In terms of interpreting evaluation results, existing deep learning models output a single risk score as the evaluation outcome. This makes it difficult for existing evaluation mechanisms to accurately identify hidden threat sources, resulting in low accuracy of evaluation results.

[0109] To address the aforementioned technical issues, embodiments of this application provide a method, apparatus, device, medium, and program product for assessing industrial control system (ICS) vulnerabilities, thereby improving the accuracy of ICS vulnerability assessment results.

[0110] The following description, in conjunction with the accompanying drawings, details the industrial control system vulnerability assessment method, apparatus, equipment, media, and program products provided in the embodiments of this application.

[0111] Figure 1 This illustration shows the network architecture of an industrial control system vulnerability hazard assessment method provided in an embodiment of this application. For example... Figure 1As shown, the network architecture includes an industrial control system vulnerability assessment device 101 and a terminal device 102. The industrial control system vulnerability assessment device 101 and the terminal device 102 are interconnected.

[0112] In some embodiments, the industrial control system vulnerability assessment device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster consisting of multiple servers. It should be noted that this application embodiment does not limit the specific device form of the industrial control system vulnerability assessment device 101. Figure 1 The example shown is a single server using the industrial control system vulnerability assessment device 101.

[0113] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone, with terminal device 102 as an example.

[0114] In some embodiments, the industrial control system vulnerability hazard assessment device 101 constructs a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on multi-source heterogeneous data of the industrial control system. The multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data. Based on the heterogeneous graph, the device extracts the cascading hazard propagation path of vulnerabilities among the vulnerability nodes, network asset nodes, and physical entity nodes using direct-connection damaging element paths and cascading propagation element paths. Based on the cascading hazard propagation path, the device generates a node embedding vector that integrates direct physical hazards and indirect cascading hazards. Based on the node embedding vector, the device generates a multi-dimensional cascading hazard score and calculates a cascading gain value and a concealed correlation influence factor based on the multi-dimensional cascading hazard score. Based on the cascading gain value and the concealed correlation influence factor, the device outputs a quantitative assessment result of the industrial control vulnerability. The terminal device 102 receives and displays the quantitative assessment result.

[0115] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0116] See Figure 2 This is a flowchart illustrating a method for assessing the risks of industrial control system vulnerabilities provided in an embodiment of this application. Figure 2 As shown, the industrial control system vulnerability hazard assessment method provided in this application embodiment can be implemented by the above-mentioned industrial control system vulnerability hazard assessment device, specifically including the following steps 201 to 205.

[0117] Step 201: The industrial control system vulnerability hazard assessment device constructs a heterogeneous map containing vulnerability nodes, network asset nodes, and physical entity nodes based on multi-source heterogeneous data of the industrial control system. This multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data.

[0118] In some embodiments, the above heterogeneous graph is used to characterize the topological associations, business operation semantics, static attribution relationships and network communication reachability of vulnerability nodes, network asset nodes and physical entity nodes in an industrial control system. At the same time, it carries the risk transmission logic of direct damage and cascading penetration, and provides structured semantic topological support for inference of cascading harm of industrial control vulnerabilities, path mining and quantitative assessment.

[0119] In some embodiments, network asset data comes from real-time scanning results of asset detection tools, including device IP, MAC address, Common Platform Enumeration (CPE), and the corresponding security partition ID. Vulnerability knowledge base data comes from standard vulnerability data, including CVE IDs and their corresponding basic score vectors from the Common Vulnerability Scoring System. Physical engineering data includes the location table and logic diagram of the PLC engineering files, as well as the system's SIL classification document. Industrial control network traffic data comes from real-time traffic mirrored from core switch ports or historical packets in PCAP format.

[0120] In some embodiments, the purpose of step 201 is to transform the isolated and heterogeneous underlying data streams in the Industrial Control System (ICS) into a structured graph carrying physical semantic features, i.e., a heterogeneous graph, which can be invoked by a deep learning model.

[0121] Step 202: Based on the above heterogeneous map, the industrial control system vulnerability hazard assessment device extracts the cascading hazard propagation path of the vulnerability among the above-mentioned vulnerability node, the above-mentioned network asset node, and the above-mentioned physical entity node by using the direct-connection damage element path and the cascading propagation element path.

[0122] In some embodiments, the industrial control system vulnerability hazard assessment device performs slice concatenation multiplication on the adjacency tensor of the heterogeneous graph to generate instance matrices corresponding to direct-connection hazard-causing meta-paths and concatenated propagation meta-paths; it traverses the instance matrix of direct-connection hazard-causing meta-paths to extract all reachable node sequences from the vulnerability node to the physical entity node via network asset nodes, generating direct hazard propagation paths; it traverses the instance matrix of concatenated propagation meta-paths to extract all reachable node sequences from the vulnerability node to other vulnerability nodes via network asset nodes, generating indirect concatenated propagation paths; and it labels each propagation path with the corresponding hazard type to form a complete concatenated hazard propagation path.

[0123] In some embodiments, the purpose of step 202 is to quantify the cascading amplification effect of vulnerabilities in an industrial control environment. Unlike traditional vulnerability assessments that only focus on the severity of a single vulnerability, step 202 constructs heterogeneous meta-path mapping business logic and utilizes an attention mechanism with physical value bias to mathematically simulate how an attacker uses a specific vulnerability as a springboard to ultimately penetrate and damage high-value physical assets. The aforementioned direct-causing meta-paths and cascading transmission meta-paths are derived from the mapping business logic to obtain the cascading hazard propagation path.

[0124] Step 203: Based on the above-mentioned cascading hazard propagation path, the industrial control system vulnerability hazard assessment device generates a node embedding vector that integrates direct physical hazards and indirect cascading hazards.

[0125] In some embodiments, the above-mentioned node embedding vector is used to integrate the self-attributes, direct physical hazard characteristics and cross-node cascading penetration correlation characteristics of industrial control vulnerability nodes, network asset nodes, and physical entity nodes, so as to uniformly characterize the comprehensive risk semantics and cascading hazard degree of nodes under multiple dimensions such as security breach, confidentiality leakage, business interruption and cross-domain penetration, and provide high-dimensional computable feature support for subsequent multi-dimensional hazard decoding, cascading gain calculation and hidden springboard vulnerability identification.

[0126] In some embodiments, the industrial control system vulnerability hazard assessment device calculates the embedding vector of each node on each metapath in the cascading hazard propagation path, and concatenates the embedding vectors to obtain the node embedding vector.

[0127] Step 204: The industrial control system vulnerability hazard assessment device generates a multi-dimensional cascaded hazard score based on the above node embedding vector, and calculates the cascaded gain value and the hidden correlation influence factor based on the above multi-dimensional cascaded hazard score.

[0128] In some embodiments, the aforementioned multidimensional cascading hazard score characterizes the actual comprehensive hazard severity of industrial control system vulnerabilities in terms of physical security, confidentiality leakage, and production availability after combining network topology and physical business value; the cascading gain value characterizes the amplification or suppression effect of industrial control system asset association and network topology on the original hazard of the vulnerability; the concealed association impact factor characterizes the proportion of risk contributed by horizontal cross-domain penetration and springboard cascading association paths in the overall vulnerability risk, and can measure the vulnerability's ability to act as a springboard for covert attacks.

[0129] In some embodiments, the industrial control system vulnerability hazard assessment device divides the node embedding vector into three independent feature components: security, confidentiality, and availability. Each component is decoded using three parallel multilayer perceptron decoders, and after mapping with a Sigmoid activation function, a three-dimensional cascaded hazard index is obtained. Weighting coefficients are dynamically allocated based on physical security level and asset topological importance, and the three-dimensional cascaded hazard index is fused to obtain a multi-dimensional cascaded hazard score. Based on the above multi-dimensional cascaded hazard score, a cascade gain value and a concealed correlation influence factor are calculated. When the concealed correlation influence factor is greater than a preset proportion, the corresponding vulnerability is marked as a concealed springboard type vulnerability.

[0130] Step 205: The industrial control system vulnerability hazard assessment device outputs the quantitative assessment results of industrial control system vulnerabilities based on the above-mentioned cascaded gain value and the above-mentioned hidden correlation influence factors.

[0131] In some embodiments, the industrial control system vulnerability hazard assessment device classifies vulnerabilities into three correction levels—underestimated, normal, and suppressed—based on the sign and range of the cascade gain value; generates a hidden springboard type vulnerability identifier for the corresponding vulnerability based on whether the hidden correlation influence factor is greater than a preset ratio; automatically classifies vulnerabilities into four risk types—physical damage type, hidden springboard type, information theft type, and general network type—based on all the above indicators; and encapsulates all fields into a structured industrial control system vulnerability cascade hazard quantitative assessment dataset, which is output as the final quantitative assessment result.

[0132] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, after step 201 above, there is also step 301, and step 203 can be implemented in detail by step 203a.

[0133] Step 301: The industrial control system vulnerability hazard assessment device constructs a generalized physical value vector for the physical entity nodes in the above heterogeneous graph.

[0134] In some embodiments, the industrial control system vulnerability assessment device first defines a node mapping function. The entities in the ICS environment are divided into three types of node sets: vulnerability nodes ( ), network asset nodes ( ) and physical entity nodes ( ).

[0135] Vulnerable node ( ): The system from Data is acquired, and the textual semantics of the vulnerabilities are fused with numerical scores. Vulnerability Nodes initial feature vector Defined as:

[0136]

[0137] in, The normalized CVSS baseline score for this vulnerability; To utilize embedded models such as Word2Vec to generate vulnerability descriptions dimensional vector; This involves concatenating vectors.

[0138] Network asset nodes ( ): Represents a physical device with an IP address (such as a PLC controller, HMI, or engineering workstation). The initial feature vector of network asset node j. Defined as:

[0139]

[0140] in, Indicates the type of equipment (such as various PLC models, servers). This indicates the security partition number to which it belongs. It is converted into a computer-readable 0 / 1 sequence using OneHot encoding.

[0141] Physical entity node ( This application constructs a generalized physical value vector based on the importance of its physical processes. This vector is defined as a A scalable vector of dimensions for the potential of the storage device across different business consequences: .

[0142] in This represents the total number of evaluation dimensions, with each component... This represents the node at the 1st rank. Value scoring is applied to different hazard types. This vector architecture supports dynamic expansion of dimensions based on the needs of actual industrial scenarios. In this embodiment, three core and typical dimensions in the industrial control field are selected for illustrative examples:

[0143]

[0144] in, For the weight of safety value, For the value of confidentiality, For usability value components, This is for generalized physical value vectors.

[0145] In some embodiments, the second building module provides a human-computer interaction interface, and the industrial control system vulnerability hazard assessment device supports the assessment of... It performs automated resolution, while also allowing manual specification or modification of physical nodes. of Scoring, sensitive address range These attributes ensure the accuracy of modeling in non-standard or encrypted environments.

[0146] Step 203a: The industrial control system vulnerability hazard assessment device generates a node embedding vector that integrates direct physical hazards and indirect cascading hazards based on the above-mentioned cascading hazard propagation path through an attention mechanism with dynamic value bias terms; wherein, the dynamic value bias terms are determined based on the above-mentioned generalized physical value vector.

[0147] In some embodiments, the industrial control system vulnerability hazard assessment device uses a node-specific linear transformation matrix to map the original features of different types of nodes to the same hidden space; extracts the security value components of physical entity nodes from the physical value matrix, adds a minimal positive smoothing term to obtain a dynamic value bias term; splices the node projection features and combines them with the dynamic value bias term to calculate the attention score, and after Softmax normalization, aggregates the neighborhood features to obtain the intermediate embedding vector of each meta-path; calculates the global semantic attention weight of each directly connected damaging meta-path, and injects the intermediate embedding vector of the cascaded passing meta-path into the intermediate embedding vector of the corresponding directly connected damaging meta-path in a residual manner through an adaptive cascaded gating unit; splices the three physical dimension feature components to generate a node embedding vector that integrates direct physical hazards and indirect cascaded hazards.

[0148] Thus, by constructing a generalized physical value vector and transforming it into a dynamic value bias term of the attention mechanism, the model can automatically prioritize the hazard transmission path connecting high-value physical assets, while integrating direct physical hazards and indirect cascading hazards, significantly improving the accuracy and comprehensiveness of industrial control system vulnerability hazard assessment.

[0149] The industrial control system vulnerability hazard assessment method provided in this application can construct a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on multi-source heterogeneous data such as network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data. This method clearly distinguishes the attribute differences and cross-domain relationships of different types of nodes. Then, it uses direct-connection damage meta-paths and cascading propagation meta-paths to extract the complete cascading hazard propagation path of the vulnerability among the three types of nodes, fully covering the entire chain propagation process of the vulnerability from the network layer to the physical layer. Finally, based on the above cascading hazard propagation path, it generates node embedding vectors that integrate direct physical hazards and indirect cascading hazards, and generates... A multi-dimensional cascaded hazard score is generated, and the cascade gain value and hidden correlation influence factor are calculated. This quantifies the role of different nodes in hazard transmission and the strength of hidden correlations. As a result, the industrial control system security assessment platform can output quantitative assessment results of industrial control system vulnerabilities that simultaneously cover both explicit direct hazards and implicit cascaded hazards, based on the aforementioned cascade gain value and hidden correlation influence factor. Therefore, it avoids the problem of low accuracy in industrial control system vulnerability hazard assessment results caused by existing graph neural network models that use network connection relationships as the sole basis for node association, treat industrial control equipment as homogeneous nodes, and conduct hazard transmission analysis based on static scoring or qualitative logical deduction of isolated vulnerabilities. This significantly improves the accuracy of industrial control system vulnerability hazard assessment.

[0150] In some embodiments, combined with Figure 2 ,like Figure 4 As shown, the generalized physical value vector includes a security value component, a confidentiality value component, and an availability value component. The industrial control system vulnerability hazard assessment method provided in this application embodiment may also include the following steps 401 to 403.

[0151] Step 401: The industrial control system vulnerability hazard assessment device determines the security value component based on the security integrity level of the physical entity node and the preset weighting coefficient of the execution logic of the physical entity node.

[0152] In some embodiments, the security value component ( This is used to characterize the risk of physical accidents (such as explosions or casualties) caused by the destruction of the component quantization node.

[0153] For example, the above-mentioned security value components ( The calculation is based on the IEC 61508 standard.

[0154]

[0155] in, The safety level of the control loop to which this physical point belongs; 4.0 is the emergency stop logic weighting coefficient; 4.0 is the normalization constant, i.e., the highest level of SIL.

[0156] Step 402: The industrial control system vulnerability assessment device determines the confidential value component based on the matching results of the memory address mapping information of the above-mentioned physical entity nodes and the preset sensitive parameter segments.

[0157] In some embodiments, the confidential value component ( The degree to which this component quantization node contains core process parameters is calculated based on the semantics of memory address segments:

[0158]

[0159] in, The memory address mapped to the physical point; and These are predefined sensitive parameter sections and ordinary monitoring sections, respectively.

[0160] Step 403: The industrial control system vulnerability hazard assessment device determines the availability value component based on the betweenness centrality of the physical entity nodes in the control logic diagram.

[0161] In some embodiments, availability value components ( ): Quantify the topological importance of nodes in the production process. The betweenness centrality of the PLC control logic diagram is used for calculation.

[0162]

[0163] in, For the logic diagram from the input point to output point The total number of shortest logical paths, For the nodes The number of shortest paths. If a point is referenced by a large number of control loops, its availability value approaches 1.

[0164] It should be noted that the execution order of steps 401, 402, and 403 described above is not limited in this embodiment. For example, step 401 can be executed first, followed by steps 402 and 403; or, step 402 can be executed first, followed by steps 401 and 403; or, steps 401, 402, and 403 can be executed simultaneously. Figure 4 This is illustrated by taking step 401 first, followed by steps 402 and 403.

[0165] In this way, the value of industrial control system vulnerabilities is quantified from three dimensions: security, confidentiality, and availability, based on the security integrity level of the physical entity, memory address mapping, and the importance of control logic topology. This makes the dynamic value bias item more closely match the actual business risks in the industrial field and significantly improves the accuracy of the assessment of the cascading harm of industrial control system vulnerabilities.

[0166] In some embodiments, combined with Figure 2 ,like Figure 5 As shown, step 201 may also include steps 201a to 201f.

[0167] Step 201a: The industrial control system vulnerability hazard assessment device constructs the aforementioned vulnerability node, network asset node, and physical entity node based on the aforementioned multi-source heterogeneous data.

[0168] Step 201b: The industrial control system vulnerability assessment device extracts the operational semantics and network connection information of industrial control network traffic data based on the deep packet inspection algorithm;

[0169] In some embodiments, network connectivity information refers to basic data extracted from industrial control network traffic data using a deep packet inspection algorithm, used to characterize the logical reachability and communication relationships between different network asset nodes in an industrial control system.

[0170] In some embodiments, network connection information is extracted from the feature quintuple of industrial control network traffic data, which includes source IP address, destination IP address, function code, register / memory address, and data payload.

[0171] In some embodiments, operational semantics refers to the core features extracted from the feature quintuple that characterize the specific operational types and business security meanings of industrial control protocol instructions. It clarifies the actual operational permissions and capability boundaries of network asset nodes to physical entity nodes and is the core basis for constructing heterogeneous graph edges with security semantics.

[0172] In some embodiments, operational semantics are extracted from feature quintuples.

[0173] Step 201c: The industrial control system vulnerability hazard assessment device constructs a semantic edge between the network asset node and the physical entity node based on the above operational semantics.

[0174] In some embodiments, semantic edges can accurately characterize the actual operational authority and security impact boundaries of network asset nodes on physical entity nodes, providing core business semantic basis for identifying the physical damage path of industrial control vulnerabilities and quantifying cascading hazards.

[0175] Step 201d: The industrial control system vulnerability hazard assessment device constructs communication edges between the network asset nodes and dependency edges between the vulnerability nodes and the network asset nodes based on the network connection information.

[0176] In some embodiments, the communication edge represents the network logical reachability between network asset nodes and serves as the topological basis for constructing cascaded transmission meta-paths, identifying attack springboards, and lateral penetration risks.

[0177] In some embodiments, the dependency edge establishes a static ownership association between the vulnerable node and its host network asset node, which is the starting point and foundation for all vulnerability risks to propagate from code defects to network devices and physical entities.

[0178] Step 201f: The industrial control system vulnerability hazard assessment device constructs the heterogeneous graph based on the aforementioned vulnerability nodes, network asset nodes, physical entity nodes, semantic edges, communication edges, and dependency edges.

[0179] The heterogeneous graph includes the direct-connection damage-causing meta-path and the cascaded transmission meta-path, which are composed of the vulnerability node, the network asset node, the physical entity node and the edge sequence and are used to define risk transmission rules. The edge sequence includes at least one of the semantic edge, the communication edge and the dependency edge.

[0180] In some embodiments, the industrial control system vulnerability hazard assessment device constructs a three-dimensional adjacency tensor with dimensions of total number of nodes × total number of nodes × number of edge types, and assigns independent tensor channels to semantic edges, communication edges, and dependency edges respectively; stores the initial feature vectors of vulnerable nodes, network asset nodes, and physical entity nodes into the node feature matrix respectively; stores the connection relationships of critical control edges and sensitive read edges into the semantic edge channel, the connection relationships of ordinary communication edges into the communication edge channel, and the affiliation relationship between vulnerable nodes and host network asset nodes into the dependency edge channel; generates a complete heterogeneous attribute graph based on the three-dimensional adjacency tensor and the node feature matrix; and predefines direct-connection damage-causing meta-paths and cascading transmission meta-paths in the heterogeneous attribute graph.

[0181] To facilitate understanding of the heterogeneous map construction process in the above embodiments, an exemplary description of feature quintuple deconstruction is provided here, including:

[0182] The industrial control system vulnerability assessment device utilizes DPI technology to analyze real-time captured industrial control system traffic data. Extract key behavioral features.

[0183] The industrial control system (ICS) vulnerability assessment device traverses every ICS protocol command message (such as Modbus TCP, S7comm, EtherNet / IP, etc.) in the mirrored traffic of ICS traffic data, and deconstructs it into a feature quintuple using the protocol parsing engine:

[0184]

[0185] The specific physical meaning of each field and its role in edge construction are as follows:

[0186] Source IP address ( ): Identifies the source device that initiated the command. In industrial control networks, this typically represents a host computer, engineering workstation, or human-machine interface (HMI). This field is used to determine the starting point of the semantic edge in the heterogeneous graph, i.e., the source network asset node. .

[0187] Destination IP address ( ): Identifies the target controller that receives and executes the instructions. This is typically a PLC, DCS control station, or remote control unit. This field is used to locate the physical asset scope to which the instructions are directed.

[0188] Function code ( ): The core operation identifier in the message. It directly determines the nature of the operation of the instruction (whether it is "read" or "write"). The system normalizes the function codes of different vendors' proprietary protocols into a unified semantic by querying the predefined "industrial atomic operation primitive set" (e.g., the Job Write of the target vendor's equipment and Modbus 0x06 are uniformly mapped to "control primitives").

[0189] Register / Memory Address ( ): Identifies the physical location within the target device where the instruction operates. For example, a specific I / O module address or recipe storage area (DB block). This field is crucial for fine-grained evaluation, allowing the system to directly connect edges to specific physical entity nodes. Instead of vaguely connecting to the entire PLC.

[0190] Data payload ( ): The specific value carried by the instruction (e.g., setting the frequency to 50Hz, or issuing a closing instruction). Although the main focus during edge construction is on the operation type and location, this field can help determine the degree of abnormality in the operation.

[0191] In this way, by instantiating three types of nodes—vulnerabilities, network assets, and physical entities—through multi-source heterogeneous data, and combining the operational semantics extracted by deep packet inspection with network connection information, semantic edges, communication edges, and dependency edges are constructed. This generates a heterogeneous graph containing direct-connection damage and cascading transmission meta-paths, achieving a deep integration of network topology, business semantics, and physical value in the industrial control environment. This provides a high-fidelity structured foundation for the subsequent accurate identification of the physical damage path of vulnerabilities and the quantification of cascading hazards.

[0192] In some embodiments, combined with Figure 5 ,like Figure 6As shown, the semantic edges mentioned above include key control edges and sensitive read edges; the operational semantics mentioned above include write operation primitives and read operation primitives; step 201c may also include step 201c1 and step 201c2.

[0193] Step 201c1: If the above operation semantics are the above write operation primitives and the security value component corresponding to the above physical entity node is higher than the preset threshold, then construct a critical control edge.

[0194] In some embodiments, if the function code displays the operation semantics of the above-mentioned write operation primitive and the security value component corresponding to the above-mentioned physical entity node is higher than a preset threshold, then a critical control edge is constructed.

[0195] Step 201c2: If the above operation semantics are the above read operation primitives and the confidential value component corresponding to the above physical entity node is higher than the preset threshold, then construct a sensitive read edge.

[0196] In some embodiments, if the function code displays the operation semantics of the above-mentioned read operation primitive and the confidential value component corresponding to the above-mentioned physical entity node is higher than a preset threshold, then a sensitive read edge is constructed.

[0197] In some embodiments, at network asset nodes With physical entity nodes Establish connections with explicit security semantics between them.

[0198] To facilitate understanding of the construction process of the semantic edges and communication edges mentioned above, this application provides an exemplary description, including:

[0199] Based on mapping relationship and the extracted quintuple The industrial control system vulnerability assessment device uses the following logic to determine and establish semantic edges and communication edges, where E is the set of edges:

[0200] Critical control edge ( The determination condition for ) is: when It belongs to the "set of write operation primitives" (referring to instructions capable of modifying physical state), and The corresponding physical node It has high security value ( (When...) Construction behavior: Generate control edges from the source asset (network asset node) to the target physical location. This indicates that the network device possesses either unauthorized control capabilities or legitimate control permissions over "high-risk physical actuators" in industrial control production.

[0201] Sensitive read edge ( The determination condition for ) is: when It belongs to the "set of read operation primitives" and Mapped physical nodes It contains core process or confidential parameters ( (When...) Construction behavior: Generate semantic edges for reading. This indicates that the asset possesses a risky channel for obtaining the company's core production secrets (such as chemical formulas and processing parameters).

[0202] Ordinary communication side ( The criteria for determining whether a function is sensitive are: only TCP / UDP connections are identified in the 5-tuple, or the function code does not fall within the scope of sensitive operations (e.g., simple device heartbeat detection, status query of non-critical points). Construction behavior: Generate ordinary connection edges between assets, i.e., between network asset nodes. .

[0203] In this way, by binding write operations with the security value of physical entities and read operations with the confidentiality value of physical entities and setting threshold judgments, differentiated key control edges and sensitive read edges are constructed, achieving fine-grained semantic distinction between physical control risks and data leakage risks in industrial control networks, providing a core basis for subsequent multi-dimensional and precise quantification of cascading hazards.

[0204] In some embodiments, the aforementioned direct-connection damage-causing meta-path includes a security breach path, a confidentiality leakage path, and a service interruption path; the aforementioned cascading transmission meta-path includes a cross-domain penetration path.

[0205] In some embodiments, the aforementioned security breach path sequentially passes through a vulnerability node, a network asset node, and a physical entity node. The vulnerability node and the network asset node are connected by a dependency edge, the network asset node and the physical entity node are connected by a semantic edge, and furthermore, the network asset node and the physical entity node are connected by a critical control edge.

[0206] In some embodiments, the aforementioned confidentiality disclosure path sequentially passes through a vulnerability node, a network asset node, and a physical entity node, with the vulnerability node and the network asset node connected by a dependency edge, and the network asset node and the physical entity node connected by a sensitive read edge.

[0207] In some embodiments, the aforementioned service interruption path sequentially passes through a vulnerability node, a first network asset node, and a second network asset node, with the vulnerability node and the first network asset node connected via a dependency edge, and the first network asset node and the second network asset node connected via a communication edge.

[0208] In some embodiments, the cross-domain penetration path passes through the first vulnerability node, the first network asset node, the second network asset node, and the second vulnerability node in sequence. The first vulnerability node and the first network asset node are connected by a dependency edge, the first network asset node and the second network asset node are connected by a communication edge, and the second network asset node and the second vulnerability node are connected by a dependency edge.

[0209] In some embodiments, combined with Figure 2 ,like Figure 7 As shown, the above-mentioned cascaded transmission meta-path includes a cross-domain penetration path, and step 202 specifically includes steps 202a to 202h.

[0210] Step 202a: The industrial control system vulnerability hazard assessment device generates an adjacency tensor of a preset dimension based on the above heterogeneous graph;

[0211] In some embodiments, the adjacency tensor mentioned above includes, but is not limited to, a three-dimensional adjacency tensor of total number of nodes × total number of nodes × number of edge types. Therefore, it should be understood that this application does not limit the preset dimension to three dimensions.

[0212] Step 202b: The industrial control vulnerability hazard assessment device extracts the first channel slice corresponding to the above-mentioned dependent edge, the second channel slice corresponding to the above-mentioned critical control edge, the third channel slice corresponding to the above-mentioned sensitive read edge, and the fourth channel slice corresponding to the above-mentioned communication edge from the above-mentioned adjacency tensor.

[0213] In some embodiments, the industrial control system vulnerability hazard assessment device performs channel slicing operation on a three-dimensional adjacency tensor with dimensions of N×N×4, extracting the first channel slice corresponding to the dependent edge at index 0, the second channel slice corresponding to the critical control edge at index 1, the third channel slice corresponding to the sensitive read edge at index 2, and the fourth channel slice corresponding to the communication edge at index 3, with each slice being an N×N two-dimensional adjacency matrix.

[0214] Step 202c: The industrial control system vulnerability hazard assessment device generates a path instance matrix of security breach paths based on the first channel slice and the second channel slice.

[0215] In some embodiments, the industrial control system vulnerability hazard assessment device performs matrix multiplication on the first channel slice and the second channel slice to calculate the reachability of the vulnerability node to the network asset node via the dependency edge and then to the physical entity node via the critical control edge, generating a path instance matrix of security breach paths, where a matrix element of 1 indicates the existence of a corresponding path.

[0216] Step 202d: The industrial control system vulnerability hazard assessment device generates a path instance matrix of confidential leakage paths based on the first channel slice and the third channel slice mentioned above.

[0217] In some embodiments, the industrial control system vulnerability hazard assessment device performs matrix multiplication on the first channel slice and the third channel slice to calculate the reachability of the vulnerability node to the network asset node via the dependency edge and then to the physical entity node via the sensitive read edge, generating a path instance matrix of confidential leakage paths, where a matrix element of 1 indicates the existence of a corresponding path.

[0218] Step 202e: The industrial control system vulnerability hazard assessment device generates a path instance matrix of service interruption paths based on the first channel slice and the fourth channel slice.

[0219] In some embodiments, the industrial control system vulnerability hazard assessment device performs matrix multiplication on the first channel slice and the fourth channel slice to calculate the reachability of the vulnerability node to the host network asset node via the dependency edge and then to other network asset nodes via the communication edge, thereby generating a path instance matrix of the service interruption path.

[0220] Step 202f: The industrial control system vulnerability hazard assessment device generates a path instance matrix of cross-domain penetration paths based on the path instance matrix of the aforementioned service interruption paths included in the aforementioned direct-connection damage source paths and the transposed first channel slice.

[0221] In some embodiments, the industrial control system vulnerability hazard assessment device performs matrix multiplication on the path instance matrix of the service interruption path and the transposed first channel slice to calculate the reachability of the vulnerability node to other vulnerability nodes after lateral penetration through the network asset node, and generates a path instance matrix of the cross-domain penetration path.

[0222] Step 202g: The industrial control system vulnerability hazard assessment device extracts the unique node identifiers corresponding to the aforementioned vulnerability nodes, network asset nodes, and physical entity nodes from all path instance matrices, and constructs a node connection order identifier sequence based on the aforementioned unique node identifiers.

[0223] In some embodiments, the industrial control system vulnerability hazard assessment device traverses all path instance matrices, extracts the unique identifiers of the source and target nodes corresponding to the non-zero elements, arranges them according to the path propagation order, constructs a node connection order identifier sequence after deduplication, and records the sequential connection relationship of nodes in each path.

[0224] It should be understood that the above four path instance matrices are merely illustrative examples, and this application does not limit itself to constructing only the above four path instance matrices.

[0225] Step 202h: The industrial control system vulnerability hazard assessment device generates the above-mentioned cascading hazard propagation path based on the above-mentioned node connection sequence identifier sequence.

[0226] In some embodiments, the industrial control system vulnerability hazard assessment device maps the connection sequence identifier of each node to the corresponding cascading hazard propagation path, and labels each path with the corresponding hazard type (security breach, confidentiality leakage, etc.), ultimately forming a complete cascading hazard propagation path.

[0227] To facilitate understanding of the process of constructing the cascading hazard propagation path described above, this application provides an exemplary description, including: converting the entity attributes, static attribution relationships, and dynamic operational semantics identified in the above steps into mathematical tensors and matrices that can be directly processed by the industrial control system vulnerability hazard assessment device. By constructing adjacency tensors and value matrices, a digital mapping from the business logic space to a high-dimensional tensor space is achieved. The industrial control system vulnerability hazard assessment device calculates the cascading hazard propagation path based on the adjacency tensors and value matrices.

[0228] Before generating the adjacency tensor and value matrix, the industrial control system vulnerability hazard assessment device first establishes a unique coordinate index for all discrete elements in the heterogeneous graph:

[0229] Node index mapping: Establishing a global mapping function , will set All vulnerable nodes in ( ), network asset nodes ( ) and physical entity nodes ( Arrange them sequentially and assign them unique integer numbers. (Symbols) This represents the total number of nodes in the graph. Semantic relation mapping: Establishing relation mapping functions. To adapt to the meta-path definition required by the cascading hazard reasoning module, the system inductively maps the edge relationships generated in step 1.2 into four core channels of the third dimension of the tensor. ):

[0230] Channel 1: Existence and Attribution Relationships Channel 1: This channel represents a static dependency relationship and is the foundation for constructing the reasoning path. Channel 2: Key Control Relationship ( ): Corresponds to the write operation command parsed from the dynamic traffic, representing the ability to modify the physical state. Channel 3: Sensitive read relationship ( Channel 4: Network connectivity (This refers to the read operation command parsed from the dynamic traffic, representing the ability to acquire confidential data.) ): Corresponds to ordinary network communication connections, representing the logical reachability at the network layer.

[0231] The industrial control system vulnerability hazard assessment device then constructs a dimension of... 3D adjacency tensor Used to store cross-domain topology and business instruction association features: Create an all-zero tensor Assignment operation: The industrial control system vulnerability assessment device traverses the edge set. Assign values ​​based on edge type: if the edge is statically associated, set... If the edge is a dynamic key control, set... If the edge is dynamically sensitive to reading, set... If the edge is a regular network connection, set... An edge can be any of the following: a communication edge, a semantic edge, or a dependency edge.

[0232] The industrial control system vulnerability hazard assessment device will reconstruct another dimension. Physical value matrix . The row number of the matrix corresponds to the node index. The number of columns corresponds to the three-dimensional physical value components. The industrial control system vulnerability assessment device traverses nodes line by line. If the node is determined to be a physical entity node in step 1.1 ( Then, the three-dimensional physical value vector calculated from the above content will be... Fill in the matrix Okay, that is If the node is not a physical entity node (such as a vulnerability or network device), then all elements in that row will be filled with 0.

[0233] In some embodiments, the adjacency tensor With physical value matrix This will serve as the direct input for generating the aforementioned cascading hazard propagation path. Among them, The values ​​in the value set will directly affect the dynamic value bias term. The calculation formula ensures that the assessment process can perceive the physical importance of core assets in real time, thereby solving the problem of the disconnect between traditional assessment methods and business consequences.

[0234] To enable the industrial control system vulnerability assessment device to understand attack paths in industrial control networks, this application predefines two types of sets of four meta-paths. Metapaths are defined as composite functions of relationships between nodes, used to capture risk propagation across levels.

[0235] Level 1: Direct physical damage path ( This type of path describes the risks when the vulnerable host device has direct physical operation privileges:

[0236] Security breach path ( ): This approach measures the direct risk of unintended actions in physical actuators (such as valves and motors) caused by exploiting vulnerabilities through "writing class operation primitives".

[0237] Confidential leakage path ( ): This path quantifies how attackers read sensitive memory addresses associated with physical nodes (such as recipe areas). The ability to steal production data.

[0238] Service interruption path ( ): This path describes the risk that exploiting the vulnerability could lead to the shutdown of industrial control equipment and network link congestion.

[0239] Level 2: Cascaded penetration path ( This is the core of quantitative vulnerability correlation, used to identify covert attack springboards:

[0240] Cross-domain penetration path ( ): After an attacker gains control of host A by exploiting vulnerability A, they can then leverage the logical reachability between host A and host B to further exploit vulnerability B across security domains. This cascading logic enables the model to discover high-value springboard vulnerabilities that have low individual scores but can reach core areas.

[0241] To efficiently retrieve these paths in computation, this application employs the tensor slice concatenation method to generate the meta-path instance matrix: Generation of direct-connection lossy path instances:

[0242] With security breach path ( For example, its path instance matrix Calculated using the following formula:

[0243]

[0244] in, The existence and location of the adjacency tensor are "slices" (representing the device to which the vulnerability belongs). This represents a critical control slice (characterizing the physical locations of equipment controls). The result of matrix multiplication. Indicates the vulnerable node Physical nodes can be controlled via specific paths. .

[0245] Cascaded penetration path instance generation: For cross-domain penetration paths ( The system constructs a reachability matrix from the source vulnerability to the target vulnerability:

[0246]

[0247] This operation simulates "Vulnerability A" Host A (Network connection) Host B The redirection process of "Vulnerability B" is described. Based on this, a cascading hazard propagation path is derived, including cascading penetration paths and direct physical damage paths.

[0248] Thus, by constructing a multi-channel adjacency tensor and using tensor slicing and matrix multiplication, four types of hazard path instances—security breach, confidentiality leakage, business interruption, and cross-domain penetration—are automatically enumerated and generated. This leads to the construction of a complete set of cascading hazard propagation paths, enabling efficient, comprehensive, and accurate identification of industrial control system vulnerability attack paths. This provides precise topological constraints for subsequent feature aggregation and cascading hazard quantitative assessment using attention mechanisms.

[0249] In some embodiments, combined with Figure 3 ,like Figure 8 As shown, step 203a above specifically includes steps 203a1 to 203a7.

[0250] 203a1. The industrial control system vulnerability hazard assessment device determines a dynamic value bias term based on the generalized physical value vector of the adjacent nodes of any node in the above-mentioned cascaded hazard propagation path, wherein any node and the adjacent nodes are any one of the above-mentioned vulnerability node, the above-mentioned network asset node and the above-mentioned physical entity node.

[0251] In some embodiments, the industrial control system vulnerability hazard assessment device traverses all adjacent nodes of each node in the cascaded hazard propagation path and extracts the generalized physical value vector of the adjacent nodes from the physical value matrix. If the adjacent node is a physical entity node, its security value component is taken as the base value, and a very small positive smoothing term ξ=1e-6 is added to obtain the dynamic value bias term. If the adjacent node is a non-physical entity node, the dynamic value bias term is directly taken as the smoothing term ξ.

[0252] 203a2. The industrial control system vulnerability hazard assessment device calculates the basic attention score between any of the above nodes and the above adjacent nodes;

[0253] In some embodiments, the industrial control system vulnerability assessment device uses a node-type-specific linear transformation matrix to project the original feature vectors of the current node and its neighboring nodes into a hidden space of the same dimension; the two projected feature vectors are concatenated, linearly transformed by the attention parameter vector specific to the corresponding metapath, and then processed by the LeakyReLU activation function to obtain the basic attention score.

[0254] 203a3, The industrial control system vulnerability hazard assessment device weights and amplifies the basic attention score based on the aforementioned dynamic value bias term;

[0255] In some embodiments, the industrial control system vulnerability hazard assessment device takes the natural logarithm of the dynamic value bias term, multiplies it by the physical sensitivity hyperparameter γ, and superimposes the result onto the basic attention score to complete the weighted amplification of the attention score; this operation enables the path connecting high-value physical nodes to obtain significantly higher attention weights, realizing the dynamic guidance of physical value on risk assessment.

[0256] 203a4. The industrial control system vulnerability hazard assessment device performs weighted aggregation on the projection features of the above adjacent nodes based on the weighted attention score, and obtains the semantic embedding of security breach path, confidentiality leakage path, business interruption path, and cross-domain penetration path corresponding to any of the above nodes.

[0257] In some embodiments, the industrial control system vulnerability hazard assessment device performs Softmax normalization on the weighted attention scores of all neighboring nodes of the current node to obtain the attention coefficients of each neighboring node; the attention coefficients are used to perform weighted summation on the projected features of neighboring nodes to generate semantic embedding vectors corresponding to the four meta-paths of security breach, confidentiality leakage, business interruption and cross-domain penetration.

[0258] 203a5. The industrial control system vulnerability hazard assessment device performs semantic-level aggregation on the semantic embedding of the above-mentioned security breach path, the semantic embedding of the above-mentioned confidentiality leakage path, and the semantic embedding of the above-mentioned business interruption path to obtain direct connection path features.

[0259] In some embodiments, the industrial control system vulnerability hazard assessment device calculates the global semantic attention weights of three directly connected damage-causing meta-paths: security breach, confidentiality leakage, and business interruption; and uses these weights to perform weighted aggregation of the semantic embedding vectors of the three paths to obtain a directly connected path feature vector that integrates the three types of direct physical hazard features.

[0260] 203a6. The industrial control system vulnerability hazard assessment device performs semantic-level aggregation on the semantic embedding of the above-mentioned cross-domain penetration path to obtain cascaded path features;

[0261] In some embodiments, the industrial control system vulnerability hazard assessment device performs semantic-level aggregation operations on the semantic embedding vector of cross-domain penetration paths. Through learnable semantic transformation matrices and bias vectors, it extracts the associated risk features of cross-node lateral penetration and generates cascading path feature vectors that characterize indirect cascading hazards.

[0262] 203a7. The industrial control system vulnerability hazard assessment device uses an adaptive cascaded gating unit to perform residual fusion of the above-mentioned cascaded path features and the above-mentioned direct path features to generate the above-mentioned node embedding vector that integrates direct physical hazards and indirect cascaded hazards.

[0263] To facilitate understanding of the above-described node embedding vector generation process, this application provides an exemplary description, including:

[0264] The industrial control system vulnerability hazard assessment device assesses each of the above meta-paths. Train independent attention weights to identify the factors influencing the final harm of different paths.

[0265] For path The following vulnerable nodes and its neighboring nodes :

[0266] Heterogeneous spatial feature projection: due to (Text + Rating) and (The three-dimensional value vector) is in a heterogeneous space, and is first transformed by a linear transformation matrix. Project each node to Hidden Space:

[0267]

[0268] in, It is the projected node feature vector, with dimension . ; It is a learnable weight matrix for a specific node type, with dimension . ; It is the bias vector of the corresponding type, with dimension . .

[0269] Physical risk bias injection: Attention score between computation nodes At that time, a dynamic bias term is introduced. This item is not randomly generated by the model, but rather is a physical value vector produced by Module 1. It was decided directly.

[0270]

[0271] in, It is a node For nodes In metapath The unnormalized importance score; It is a non-linear activation function used to process negative inputs; Metapath A dedicated attention parameter vector, with dimensions of [dimensionality missing]. ; It is a vector concatenation operation; It is a physical sensitivity hyperparameter used to adjust the weight of the bias term, and can be learned or preset.

[0272] To clarify the bias term Regarding the specific numerical mapping mechanism, this application adopts a segmented mapping strategy based on physical security levels, as implemented as follows:

[0273] Physical value extraction and mapping: Physical value matrix output by the system traversal module 1 If neighboring nodes If it is a physical entity node, then extract its corresponding security value component. As a base bias value. Assume the node... A critical high-pressure relief valve on site is classified as SIL3 in the SIL classification document (corresponding to...). If the bias term of the connection is then assigned a value of , then the bias term of the connection is assigned a value of . Assume a node This corresponds to only one ordinary "status indicator light", which is at level SIL0 (corresponding to...). Then assign a value. Substituting the above values ​​into the logarithmic term of the attention formula Perform the calculations: For a high-pressure relief valve: For status indicator lights: The mathematical difference between the two is approximately 2.02. After Softmax exponential normalization, this logarithmic difference is transformed into an order-of-magnitude difference in the probability domain. This means that, given similar features, the attention weight the model assigns to the "high-pressure relief valve" path will be several times or even tens of times greater than that to the "status indicator" path.

[0274] Numerical stability handling: Considering the existence of purely network nodes with no physical connection in the real environment (i.e., ), in order to avoid To address the computational overflow caused by this, the present invention employs a smoothing formula in its implementation: (in (where the value is a very small positive number) to ensure the numerical stability of the calculation process.

[0275] Neighborhood aggregation: After Softmax normalization, the nodes are obtained. In the path Semantic embedding under:

[0276]

[0277]

[0278] in Represents a node In metapath The set of neighboring nodes; The normalized attention coefficients represent the neighboring nodes. Physical risks to nodes The actual influencing factors.

[0279] In order to accurately simulate the superposition effect of "direct physical hazards" and "indirect cascading hazards" in the feature space, this invention designs a residual fusion algorithm based on a gating mechanism and uses a contrastive learning paradigm for unsupervised training.

[0280] In the preceding steps, the vulnerable nodes have already been obtained. Semantic embedding vectors under different meta-paths (e.g.) To differentiate the importance of different physical consequences in the current scenario, the semantic attention weights of each physical metapath are first calculated. :

[0281]

[0282]

[0283] in: and It is a semantically learnable transformation matrix and bias; It is a semantic-level attention vector; It is a path The global importance weight.

[0284] To simulate the uncertainty of the springboard effect in an attack chain (i.e., not all associated vulnerabilities will be successfully exploited), this invention designs an adaptive cascading gating unit to dynamically adjust the injection ratio. The industrial control system vulnerability hazard assessment device constructs three independent feature components, corresponding to the three decoding dimensions required by module three. For each physical dimension (in terms of security dimension...) (For example), the fusion formula is as follows:

[0285] A. Gating coefficient calculation:

[0286]

[0287] B. Residual Fusion:

[0288]

[0289] Similarly, calculate and .in It is the Sigmoid activation function, which maps the gating coefficients to... interval; This indicates vector concatenation; It is an adaptive cascaded gating coefficient, used when the model determines the associated risk of the vulnerability ( When it has a significant enhancing effect on physical security, If the value approaches 1, full injection of cascaded features is performed; conversely, if the value approaches 0, noise is suppressed. It is a linear transformation matrix used to map the features of cascaded paths to the physical dimension of the target; This indicates element-wise multiplication.

[0290] The three fused components are concatenated to form the final node embedding vector. :

[0291]

[0292] In some embodiments, the industrial control system vulnerability assessment device has a self-supervised learning mechanism, specifically including:

[0293] The industrial control system vulnerability assessment device employs a self-supervised strategy that maximizes mutual information for pre-training. It uses a graph contrastive loss function based on InfoNCE Loss.

[0294]

[0295] Selecting meta-paths in heterogeneous graphs Physically reachable, and the magnitude of the physical value vector. Higher physical node embeddings as positive samples Randomly select physically isolated (unreachable) or physically low-value (e.g., ordinary PC) nodes in the graph as negative samples. . The cosine similarity function; Let be the temperature coefficient. By minimizing this loss function, the model in the industrial control system vulnerability hazard assessment device is forced to automatically narrow the distance between the destructive consequences of high-risk vulnerabilities and high-value physical entities in the feature space, thereby learning to identify potential cascading threats without labels.

[0296] In some embodiments, the industrial control system vulnerability hazard assessment device calculates the gating coefficient through an adaptive cascaded gating unit and dynamically adjusts the injection ratio of cascaded path features; after linear transformation, the cascaded path features are superimposed onto the direct path features of the corresponding dimension in a residual manner; finally, the fused features of the three dimensions of security, confidentiality, and availability are spliced ​​together to generate the final node embedding vector.

[0297] Thus, by introducing a dynamic value bias attention mechanism based on generalized physical value vectors, the semantic features of direct damage and cascading penetration paths are aggregated respectively, and residual fusion is achieved through adaptive cascading gating units to generate high-fidelity node embedding vectors that fuse direct physical hazards and indirect cascading hazards. This effectively solves the problems of traditional assessment methods being disconnected from business physical consequences and insufficient quantification of cascading risks, and provides a high-quality feature foundation for the accurate decoding of subsequent multi-dimensional cascading hazards.

[0298] In some embodiments, the aforementioned multidimensional cascade hazard score includes a physical security cascade score, a confidentiality leakage cascade score, and a production disruption cascade score.

[0299] In some embodiments, combined with Figure 2 ,like Figure 9 Step 204 shown specifically includes steps 204a and 204b.

[0300] Step 204a: The industrial control system vulnerability hazard assessment device determines the aforementioned cascade gain value based on the first difference between the comprehensive cascade hazard score after weighted fusion of multi-dimensional cascade hazard scores and the original basic vulnerability score.

[0301] In some embodiments, the industrial control system vulnerability hazard assessment device first automatically assigns dynamic priority factors α, β, and γ (satisfying α+β+γ=1) according to asset attributes, and weights and fuses the cascade hazard scores of the three dimensions of physical security, confidentiality leakage, and production interruption to obtain a comprehensive cascade hazard score; then it calculates the first difference between the comprehensive score and the original CVSS base score of the vulnerability, which is the cascade gain value; a positive gain indicates that the actual hazard of the vulnerability is underestimated, and a negative gain indicates that the vulnerability hazard is suppressed by the environment.

[0302] Step 204b: The industrial control system vulnerability hazard assessment device determines the hidden correlation influence factor by using the ratio of the second difference of the physical security cascade score recalculated after severing the correlation path between vulnerabilities to the actual physical security cascade score.

[0303] In some embodiments, the industrial control system vulnerability hazard assessment device artificially cuts off all lateral correlation paths of vulnerabilities (cascade factor μ=0) through ablation experiments, and recalculates the theoretical physical security cascade score; calculates the second difference between the actual physical security cascade score and the theoretical score, divides the difference by the actual physical security cascade score and multiplies it by 100% to obtain the hidden correlation influence factor; if the value is greater than 50%, the vulnerability is identified as a hidden springboard type vulnerability.

[0304] In this way, by calculating the cascade gain value to quantify the amplification or suppression effect of industrial environment topology on the harm of vulnerabilities, and by calculating the hidden correlation influence factor through ablation experiments to accurately identify the core hidden springboard type vulnerabilities in the attack chain, a multi-dimensional and refined quantitative assessment of the actual harm of industrial control vulnerabilities is achieved, providing a scientific and quantifiable decision-making basis for the formulation and prioritization of security protection strategies.

[0305] To facilitate understanding of the calculation process for the aforementioned cascaded gain values, hidden correlation influence factors, and quantitative evaluation results, this application provides an exemplary description, including:

[0306] Cascaded Hazard Embedding Matrix ( ): This is the output from the steps described above. Each row of this matrix corresponds to a specific vulnerability node. .vector The physical damage path characteristics have been deeply integrated through a cascaded residual fusion algorithm. ) and characteristics of penetration path ( ).

[0307] Original vulnerability score ( The base score (CVSSv3.1) is derived from the vulnerability knowledge base (such as NVD) obtained in the steps above. It represents the original severity of the vulnerability's code flaw without considering the industrial network topology and physical service value.

[0308] To transform abstract feature vectors into business-readable security metrics, this invention constructs a scalable multi-task parallel decoding architecture. This evaluation framework is not limited to specific hazard types; this embodiment focuses on three dimensions: "physical security," "confidentiality," and "production availability." However, in practical applications, by configuring feature segmentation layers and adding parallel decoder branches, the industrial control system vulnerability hazard assessment device can also support the evaluation of other dimensions. This is to transform abstract feature vectors into metrics aligned with industrial security standards. To differentiate the metrics, this invention constructs three parallel MLP decoders.

[0309] First, the industrial control system vulnerability assessment device analyzes the input feature vector. Perform feature segmentation and decomposition:

[0310]

[0311] in," "" represents the vector concatenation operator. The three components are split off. (Security dimension features) (Confidentiality Dimension Features) and The (availability dimension features) all include the cascading risk features of module 2 injection. .

[0312] To determine the weight matrix in the MLP ( ) and bias term ( This industrial control system vulnerability hazard assessment device adopts a fine-tuning strategy based on a small sample of expert anchor points. First, a small number of typical industrial control scenario nodes are selected as anchor point samples (e.g., the core safety instrumented system (SIS) is set to a maximum physical security score of 10, and non-critical printers are set to 0). Security experts then label the physical hazard level based on a historical incident database. Subsequently, the mean squared error (MSE) loss function is constructed:

[0313]

[0314] in, The size of the anchor point sample set, and The first The predicted score and expert-annotated score for each sample.

[0315] This loss is minimized by the backpropagation algorithm, and the unsupervised abstract features generated by the preceding module ( It forces alignment to the industrially common 0-10 fractional space, thereby giving the decoder the ability to make judgments that are physically interpretable.

[0316] Based on the above components, the industrial control system vulnerability assessment device performs the following decoding calculations in parallel:

[0317] Physical security cascading index ( Quantization calculation of )

[0318]

[0319] in, The output physical security cascading score is used to quantify the overall probability (including the probability of cascading damage) of the vulnerability causing physical explosions, casualties, and other accidents. and These are the weight matrix and bias term specific to the physical security decoder, and their values ​​are trained and fixed during the system initialization phase through the above parameter optimization strategy. The Sigmoid activation function is calculated using the following formula: Used to map feature space results to interval; The scaling factor is designed to stretch fractions to a scale commonly used in industrial control applications. Component range.

[0320] Confidentiality Cascade Index (CCI) Quantization calculation of )

[0321]

[0322] This is used to quantify the overall probability that the vulnerability will lead to the leakage of confidential information such as core process formulas and production parameters.

[0323] Production Disruption Cascade Index ( Quantization calculation of )

[0324]

[0325] This is used to quantify the combined probability of the vulnerability causing system downtime, logic interruption, or reduced output.

[0326] It is important to understand that this step aims to accurately measure the amplification effect of industrial environment topology on the threat of vulnerabilities. Considering the differences in security objectives between industrial control systems and traditional IT systems, this invention employs an adaptive weighted fusion algorithm based on scenario priority.

[0327] A. Calculate the comprehensive cascading hazard score ( )

[0328]

[0329] in: As a dynamic priority factor, satisfying .

[0330] Automatic adaptation strategy: During the initialization of the industrial control system vulnerability assessment device, the inherent attributes of assets are extracted based on the input SIL classification document, asset list, and network topology. If an asset belongs to a high-risk SIL3 / 4 loop, its security weight is increased. If an asset is identified as a core controller with high betweenness centrality or a server located in a sensitive data area, its availability weight will be automatically increased accordingly. or confidentiality weight Based on this, the system provides a human-computer interaction interface for parameter configuration, allowing safety experts to manually adjust the initial factors, thereby ensuring that the evaluation strategy can flexibly adapt to the complex and ever-changing actual needs of industrial sites.

[0331] B. Calculate the cascade gain ( )

[0332]

[0333] Decision logic and its defensive significance:

[0334] Positive gain is significant ( This indicates that although the vulnerability has a low base CVSS score, its actual harm is seriously underestimated because it is connected to high-value physical assets in the graph or is in a critical cascading path.

[0335] No gain ( The statement indicates that the vulnerability's harm primarily stems from its own code attributes and does not possess any special cascading amplification effect in the current topology environment.

[0336] negative gain ( This indicates that although the vulnerability has a high base score, its actual physical harm is suppressed by environmental factors because it is located in a physically isolated area or a non-critical security domain.

[0337] Furthermore, it is important to understand that in order to accurately quantify the weight of the cascading effect between vulnerabilities in the final risk score, the system performs ablation experiments.

[0338] Calculation based on benchmark: Definition Assuming cascade factors in Module 2 The theoretical security index calculated by the decoder when all lateral paths of vulnerabilities are artificially severed. Influence factor formula:

[0339]

[0340] This ratio quantifies the nodes. Risks are linked through cascading penetration pathways ( The proportion that seeps in.

[0341] Hidden springboard identification logic: If The system automatically identifies it as a hidden springboard vulnerability.

[0342] Physical implications: This means that more than 50% of the harm caused by this vulnerability does not stem from its direct destructive power to physical devices, but rather from its contribution as a medium in the attack chain to spread the risk to other high-risk nodes.

[0343] Furthermore, it's important to understand that this step ultimately generates a dataset for quantitative assessment of the cascading harm of industrial control system vulnerabilities as the full assessment result, containing the following core fields:

[0344] Vulnerability ID ( ): The corresponding CVE identifier for the vulnerability.

[0345] Multidimensional cascade hazard index ( ): These represent the physical security score, confidentiality leak score, and production downtime score, respectively, after considering the environmental cascading effects.

[0346] Cascaded gain ( ): Quantify the actual correction value of the environmental topology for the vulnerability risk.

[0347] Hidden correlation influencing factors ( ) and concealed springboard identifier: used to lock onto core hub nodes in the attack path.

[0348] Risk Classification Based on the above indicators, it is automatically classified into "physical damage type", "covert springboard type", "information theft type" or "general network type".

[0349] In the node feature construction stage, this invention uses a physical three-dimensional potential energy vector as input. Alternatively, it can be replaced by constructing feature vectors based on time and environmental indicators of a general vulnerability scoring system, or by directly using knowledge graph embedding algorithms such as TransE and RotatE to automatically learn the semantic vector representation of nodes, in order to replace manually defined physical value attributes.

[0350] In some embodiments, during the association path mining stage, the present invention employs a dual semantic meta-path guided model aggregation, which can also be replaced by a graph sampling algorithm based on random walk strategies such as DeepWalk or Node2vec to capture long-distance dependencies between nodes, or by using a relational graph convolutional network to directly process the feature transfer of heterogeneous edges without explicitly defining specific paths.

[0351] In some embodiments, during the risk dynamic simulation stage, the present invention employs a value-biased attention mechanism for feature weighting, which can also be replaced by a standard multi-head graph attention network for unbiased feature aggregation, or a heterogeneous graph Transformer architecture that utilizes its meta-relationship attention mechanism to handle different types of nodes and connection relationships in the industrial control network.

[0352] In some embodiments, during the covert threat quantification stage, the present invention employs residual decoupling and cascade gain indices, which can also be replaced by the Shapley value analysis method based on game theory to calculate the marginal impact factor of a node on the total risk of the system, or by using betweenness centrality and PageRank algorithm to evaluate the pivotal position of a node in the attack propagation chain.

[0353] This invention solves the problem of invisible asset value through physical semantic digitization; it addresses the difficulty in quantifying cascading paths through a value-biased attention mechanism; and it resolves the issue of uninterpretable evaluation results through anchor fine-tuning and residual decoupling. The progressive nature of each step achieves a precise mapping from underlying heterogeneous data to upper-level quantitative evaluation.

[0354] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0355] Figure 10 This is a schematic diagram of the structure of an industrial control system vulnerability assessment system provided in an embodiment of this application. Figure 10 As shown, the industrial control system vulnerability assessment system may include: a multi-source heterogeneous data input layer, a core assessment engine based on heterogeneous graph neural computing, and a quantitative assessment result output layer.

[0356] Among them, the multi-source heterogeneous data input layer is used to transform the originally isolated and heterogeneous underlying data streams in ICS into structured graphs carrying physical semantic features, and is applied to the above steps 201 and related schemes.

[0357] The core evaluation engine based on heterogeneous graph neural computing is used to quantify the cascading amplification effect of vulnerabilities in industrial control environments. Specifically, it constructs heterogeneous metapath mapping business logic and uses an attention mechanism with physical value bias to mathematically simulate how attackers use specific vulnerabilities as springboards to ultimately penetrate and destroy high-value physical assets. This is applied to steps 202 to 203 and related schemes of steps 202 to 203.

[0358] The quantitative assessment result output layer is used for precise mapping from a high-dimensional hidden feature space to business-readable security indicators. Specifically, it utilizes a multi-task learning architecture to semantically decouple the hybrid embedding vectors generated by the core assessment engine, which contain complex cascading relationships, and produce a quantitative index with physical meaning. This index is then used to calculate the cascading gain and the influence factor of the concealment correlation, and applied to steps 204 to 205 and their related solutions. The quantitative assessment result output layer can intuitively reveal the amplification effect of the industrial control environment topology on the harm of vulnerabilities and accurately identify potential hidden springboard vulnerabilities.

[0359] Figure 10 Specifically, the demonstration showcases a multi-source heterogeneous data input layer, a core evaluation engine based on heterogeneous graph neural computing, and a quantitative evaluation result output layer. The input layer integrates four types of data: network asset detection data, standard vulnerability knowledge base, physical engineering and security data, and industrial control network traffic data. The core engine layer first completes entity node featureization, physical value calculation, and DPI-based operation semantic edge construction through a heterogeneous graph construction and physical semantic fusion module, generating a high-fidelity heterogeneous graph. Then, through a cascaded hazard reasoning and residual injection algorithm engine, a high-dimensional hazard embedding vector is generated through a two-level meta-path system construction, a dynamic value bias attention layer, and a cascaded residual semantic fusion mechanism. Finally, through a multi-dimensional cascaded hazard decoding and quantitative evaluation module, it outputs three types of indices: physical security, confidentiality leakage, and production interruption, as well as cascade gain and hidden correlation impact factor indicators. The final output layer outputs a quantitative evaluation dataset of cascaded hazards of industrial control vulnerabilities, including multi-dimensional cascaded hazard indices, cascade gains, hidden springboard vulnerability identifiers, and risk classification suggestions, realizing a full-process evaluation from multi-source data to interpretable quantitative risk results.

[0360] Figures 11 to 13 The specific method execution flow corresponds to the multi-source heterogeneous data input layer, the core evaluation engine based on heterogeneous graph neural computing, and the quantitative evaluation result output layer.

[0361] Figure 11This paper demonstrates the workflow of the heterogeneous graph construction and physical semantic fusion module in the multi-source heterogeneous data input layer: First, it inputs four types of multi-source heterogeneous data: network asset detection data, standard vulnerability knowledge base, physical engineering and security data, and industrial control network traffic data. Then, it divides into two parallel branches: the first is entity node instantiation and physical value calculation. After data preprocessing and node featureization, the physical value vector P is calculated based on security value (SIL / emergency stop weighting), confidentiality value (sensitive address mapping), and availability value (control logic centrality) to complete node instantiation. The second is operation semantic edge construction based on DPI. Through deep analysis of traffic quintuples, key control edges (write operations + high-risk nodes), sensitive read edges (read operations + sensitive nodes), and ordinary communication edges (TCP / UDP connections) are constructed according to conditions to generate fine-grained operation semantic edges. Finally, the nodes and edges are fused to generate a heterogeneous attribute graph G, an adjacency tensor A, and a physical value matrix M. Val The three core products provide structured input for subsequent cascading hazard reasoning.

[0362] Figure 12 The core assessment engine's cascading hazard reasoning and residual injection algorithm process is demonstrated: After inputting a heterogeneous attribute graph G, initial node feature vector h, and physical entity value vector P, a two-level heterogeneous meta-path system is first constructed. The first level is the direct-connection damage path (control / read / interruption), and the second level is the cascading propagation path (penetration-related springboard). Then, through a node attention layer with dynamic value bias, the node features are linearly projected and transformed. Combined with the physical value vector P, the direct-connection path features are amplified, the dynamic value item B is calculated, and the downstream high-risk vulnerability amplification effect is introduced for the cascading path. Finally, the direct-connection hazard feature vector v is obtained through biased attention weight calculation and aggregation. dir Associated hazard feature vector v corr Finally, through a cascaded residual semantic fusion mechanism, the two types of features are weighted, fused, and concatenated to generate a high-dimensional cascaded hazard embedding matrix H that integrates physical consequences and associated hazards. Final This provides a feature basis for subsequent multi-dimensional cascaded hazard decoding.

[0363] Figure 13 This demonstrates the workflow of the multi-dimensional cascaded hazard decoding and quantitative assessment module in the output layer of the quantitative assessment results: Input cascaded hazard embedding matrix H Final Compared with the original vulnerability score S Base First, high-dimensional features are segmented and fed into three types of decoders: physical security, confidentiality leakage, and production interruption, generating corresponding hazard indices which are then normalized and graded using Sigmoid. Next, cascaded gain and concealment contribution analysis are performed, calculating the cascaded gain ΔRisk to determine whether the vulnerability hazard is underestimated, has no gain, or has negative gain. Simultaneously, the concealment correlation influence factor is used... Figure 13 The hidden association contribution shown in the figure is analyzed for η.Corr It identifies hidden springboard vulnerabilities with an impact factor greater than 50%; the final output is a quantitative assessment dataset of cascading hazards of industrial control system vulnerabilities, which includes multi-dimensional cascading hazard index, cascading gain, and hidden springboard vulnerability identifiers. It achieves complete decoding and assessment from high-dimensional features to interpretable and quantifiable risk indicators.

[0364] Regarding the above Figures 11 to 13 For any parts of the content not described herein, please refer to the description of the method embodiments; this application will not repeat them here.

[0365] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0366] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0367] This application embodiment can divide the industrial control system vulnerability hazard assessment device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0368] In some embodiments, this application also provides an industrial control system (ICS) vulnerability assessment apparatus. This ICS vulnerability assessment apparatus may include one or more functional modules for implementing the ICS vulnerability assessment method described in the above embodiments.

[0369] For example, Figure 14 This is a schematic diagram of the structure of an industrial control system vulnerability assessment device provided in an embodiment of this application. Figure 14 As shown, the industrial control system vulnerability assessment device 900 includes:

[0370] The first construction module 901 is used to construct a heterogeneous graph containing vulnerability nodes, network asset nodes and physical entity nodes based on multi-source heterogeneous data of industrial control systems. The aforementioned multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data and industrial control network traffic data.

[0371] Extraction module 902 is used to extract the cascading harm propagation path of the vulnerability among the above-mentioned vulnerability node, the above-mentioned network asset node and the above-mentioned physical entity node based on the above-mentioned heterogeneous graph and by using the direct-connection harmful element path and the cascading propagation element path.

[0372] The generation module 903 is used to generate a node embedding vector that integrates direct physical hazards and indirect cascading hazards based on the above-mentioned cascading hazard propagation path.

[0373] The calculation module 904 is used to generate a multi-dimensional cascade hazard score based on the above node embedding vector, and to calculate the cascade gain value and hidden correlation influence factor based on the above multi-dimensional cascade hazard score.

[0374] Output module 905 is used to output the quantitative assessment results of industrial control system vulnerabilities based on the above-mentioned cascaded gain value and the above-mentioned hidden correlation influence factor.

[0375] The industrial control system vulnerability hazard assessment device provided in this application can construct a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on multi-source heterogeneous data such as network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data. This graph clearly distinguishes the attribute differences and cross-domain relationships of different types of nodes. Furthermore, it utilizes direct-connection damage meta-paths and cascading propagation meta-paths to extract the complete cascading hazard propagation path of vulnerabilities among the three types of nodes, fully covering the entire chain propagation process of vulnerabilities from the network layer to the physical layer. Then, based on the aforementioned cascading hazard propagation path, it generates node embedding vectors that integrate direct physical hazards and indirect cascading hazards, and generates... A multi-dimensional cascaded hazard score is generated, and the cascade gain value and hidden correlation influence factor are calculated. This quantifies the role of different nodes in hazard transmission and the strength of hidden correlations. As a result, the industrial control system security assessment platform can output quantitative assessment results of industrial control system vulnerabilities that simultaneously cover both explicit direct hazards and implicit cascaded hazards, based on the aforementioned cascade gain value and hidden correlation influence factor. Therefore, it avoids the problem of low accuracy in industrial control system vulnerability hazard assessment results caused by existing graph neural network models that use network connection relationships as the sole basis for node association, treat industrial control equipment as homogeneous nodes, and conduct hazard transmission analysis based on static scoring or qualitative logical deduction of isolated vulnerabilities. This significantly improves the accuracy of industrial control system vulnerability hazard assessment.

[0376] In some embodiments, the above-mentioned industrial control vulnerability hazard assessment device 900 further includes a second construction module, used to construct a generalized physical value vector for physical entity nodes in the above-mentioned heterogeneous graph.

[0377] Specifically, the generation module 903 is used to generate a node embedding vector that integrates direct physical hazards and indirect cascading hazards based on the aforementioned cascading hazard propagation path through an attention mechanism with a dynamic value bias term; wherein the aforementioned dynamic value bias term is determined based on the aforementioned generalized physical value vector.

[0378] In other embodiments, the generalized physical value vector described above includes a security value component, a confidentiality value component, and an availability value component.

[0379] The aforementioned industrial control system vulnerability assessment device 900 also includes:

[0380] The determination module is used to determine the security value component based on the security integrity level of the physical entity node and the preset weighting coefficient of the execution logic of the physical entity node; to determine the confidentiality value component based on the matching result of the memory address mapping information of the physical entity node and the preset sensitive parameter segment; and to determine the availability value component based on the betweenness centrality of the physical entity node in the control logic graph.

[0381] In some other embodiments, the first construction module 901 is specifically used to construct the vulnerability node, the network asset node, and the physical entity node based on the multi-source heterogeneous data; extract the operational semantics and network connection information of the industrial control network traffic data based on the deep packet inspection algorithm; construct semantic edges between the network asset node and the physical entity node according to the operational semantics; construct communication edges between the network asset nodes and dependency edges between the vulnerability node and the network asset node according to the network connection information; and construct the heterogeneous graph based on the vulnerability node, the network asset node, the physical entity node, the semantic edges, the communication edges, and the dependency edges; wherein the heterogeneous graph includes the direct-connection damage-causing meta-path and the cascaded transmission meta-path, which are composed of the vulnerability node, the network asset node, the physical entity node, and the edge sequence and are used to define risk transmission rules, and the edge sequence includes at least one of the semantic edges, the communication edges, and the dependency edges.

[0382] In some other embodiments, the semantic edge includes a key control edge and a sensitive read edge; the operation semantics include write operation primitives and read operation primitives; the first construction module 901 is further configured to construct a key control edge when the operation semantics is a write operation primitive and the security value component corresponding to the physical entity node is higher than a preset threshold; and to construct a sensitive read edge when the operation semantics is a read operation primitive and the confidentiality value component corresponding to the physical entity node is higher than a preset threshold.

[0383] In some other embodiments, the aforementioned direct-connection damage-causing meta-path includes a security breach path, a confidentiality leakage path, and a service interruption path; the aforementioned cascading transmission meta-path includes a cross-domain penetration path;

[0384] The aforementioned security breach path sequentially passes through vulnerability nodes, network asset nodes, and physical entity nodes. Vulnerability nodes and network asset nodes are connected by dependency edges, and network asset nodes and physical entity nodes are connected by semantic edges.

[0385] The aforementioned confidential information leakage path sequentially passes through the vulnerability node, the network asset node, and the physical entity node. The vulnerability node and the network asset node are connected through a dependency edge, and the network asset node and the physical entity node are connected through a sensitive read edge.

[0386] The aforementioned service interruption path passes through the vulnerability node, the first network asset node, and the second network asset node in sequence. The vulnerability node and the first network asset node are connected through a dependency edge, and the first network asset node and the second network asset node are connected through a communication edge.

[0387] The aforementioned cross-domain penetration path sequentially passes through the first vulnerable node, the first network asset node, the second network asset node, and the second vulnerable node. The first vulnerable node and the first network asset node are connected by a dependency edge, the first network asset node and the second network asset node are connected by a communication edge, and the second network asset node and the second vulnerable node are connected by a dependency edge.

[0388] In some embodiments, the aforementioned cascaded transmission meta-path includes a cross-domain penetration path; the extraction module 902 is specifically used to generate an adjacency tensor of a preset dimension based on the aforementioned heterogeneous graph; extract the first channel slice corresponding to the aforementioned dependent edge, the second channel slice corresponding to the aforementioned critical control edge, the third channel slice corresponding to the aforementioned sensitive read edge, and the fourth channel slice corresponding to the aforementioned communication edge from the aforementioned adjacency tensor; generate a path instance matrix of security breach paths based on the aforementioned first channel slice and the aforementioned second channel slice; generate a path instance matrix of confidentiality leakage paths based on the aforementioned first channel slice and the aforementioned third channel slice; generate a path instance matrix of service interruption paths based on the aforementioned first channel slice and the aforementioned fourth channel slice; generate a path instance matrix of cross-domain penetration paths based on the path instance matrix of the aforementioned service interruption paths included in the aforementioned direct-connection damage meta-path and the transposed first channel slice; extract the unique node identifiers corresponding to the aforementioned vulnerability nodes, the aforementioned network asset nodes, and the aforementioned physical entity nodes from all path instance matrices, and construct a node connection order identifier sequence based on the aforementioned unique node identifiers; generate the aforementioned cascaded hazard transmission path based on the aforementioned node connection order identifier sequence.

[0389] In some embodiments, the generation module 903 is further configured to determine a dynamic value bias term based on the generalized physical value vector of the neighboring nodes of any node in the cascading hazard propagation path, wherein any node and the neighboring nodes are any of the vulnerability nodes, network asset nodes, and physical entity nodes, respectively; calculate the basic attention score between any node and the neighboring nodes; weight and amplify the basic attention score based on the dynamic value bias term; weight and aggregate the projection features of the neighboring nodes based on the weighted attention score to obtain the semantic embeddings of the security breach path, confidentiality leakage path, business interruption path, and cross-domain penetration path corresponding to any node; perform semantic-level aggregation on the semantic embeddings of the security breach path, confidentiality leakage path, and business interruption path to obtain direct path features; perform semantic-level aggregation on the semantic embeddings of the cross-domain penetration path to obtain cascading path features; and perform residual fusion of the cascading path features and the direct path features through an adaptive cascading gating unit to generate the node embedding vector that fuses direct physical hazards and indirect cascading hazards.

[0390] In some other embodiments, the aforementioned multidimensional cascading hazard score includes a physical security cascading score, a confidentiality leakage cascading score, and a production disruption cascading score.

[0391] In some other embodiments, the calculation module 904 is specifically used to determine the cascading gain value based on the first difference between the comprehensive cascading hazard score after weighted fusion of multi-dimensional cascading hazard scores and the original basic vulnerability score; and to determine the hidden correlation influence factor based on the ratio of the second difference of the physical security cascading score recalculated after cutting off the correlation path between vulnerabilities to the actual physical security cascading score.

[0392] It should be noted that the industrial control system vulnerability hazard assessment device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0393] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 15 As shown, the electronic device 90 includes: a processor 92, a communication interface 93, and a bus 94. Optionally, the electronic device 90 may also include a memory 91.

[0394] Processor 92 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0395] Communication interface 93 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0396] The memory 91 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0397] As one possible implementation, the memory 91 can exist independently of the processor 92. The memory 91 can be connected to the processor 92 via a bus 94 and is used to store instructions or program code. When the processor 92 calls and executes the instructions or program code stored in the memory 91, it can implement the industrial control system vulnerability hazard assessment method provided in this application embodiment.

[0398] In another possible implementation, memory 91 can also be integrated with processor 92.

[0399] Bus 94 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 94 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 15 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0400] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0401] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described industrial control vulnerability hazard assessment method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0402] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0403] This application also provides a readable storage medium storing a program or instructions. When executed by a computer, the program or instructions implement the industrial control system vulnerability assessment method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The readable storage medium can be any of the foregoing embodiments or memory. The readable storage medium can also be an external storage device of the service invocation device, such as a plug-in hard drive, SmartMedia Card (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0404] This application also provides a computer program product, which is stored in a storage medium and, when executed by a computer, implements the industrial control vulnerability hazard assessment method provided in the above embodiments.

[0405] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0406] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0407] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for assessing the hazard of industrial control system vulnerabilities, characterized in that, include: Based on multi-source heterogeneous data from industrial control systems, a heterogeneous graph is constructed that includes vulnerability nodes, network asset nodes, and physical entity nodes. The multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data. Based on the heterogeneous graph, the cascading harm propagation path of the vulnerability is extracted between the vulnerability node, the network asset node and the physical entity node by using the direct-connection harmful element path and the cascading propagation element path. Based on the cascading hazard propagation path, a node embedding vector that integrates direct physical hazards and indirect cascading hazards is generated; Based on the node embedding vector, a multidimensional cascade hazard score is generated, and the cascade gain value and hidden correlation influence factor are calculated based on the multidimensional cascade hazard score. Based on the cascaded gain value and the hidden correlation influence factor, the quantitative assessment result of the industrial control system vulnerability is output.

2. The industrial control system vulnerability hazard assessment method according to claim 1, characterized in that, After constructing a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on the multi-source heterogeneous data, the industrial control system vulnerability hazard assessment method further includes: Construct a generalized physical value vector for the physical entity nodes in the heterogeneous graph; The generation of node embedding vectors that fuse direct physical hazards and indirect cascading hazards based on the cascading hazard propagation path includes: By using an attention mechanism with dynamic value bias, a node embedding vector that integrates direct physical hazards and indirect cascade hazards is generated based on the cascade hazard propagation path. The dynamic value bias term is determined based on the generalized physical value vector.

3. The industrial control system vulnerability hazard assessment method according to claim 2, characterized in that, The generalized physical value vector includes a security value component, a confidentiality value component, and an availability value component. The industrial control system vulnerability hazard assessment method also includes: The security value component is determined based on the security integrity level of the physical entity node and the preset weighting coefficient of the execution logic of the physical entity node; Based on the matching results between the memory address mapping information of the physical entity node and the preset sensitive parameter segment, the confidential value component is determined; The availability value component is determined based on the betweenness centrality of the physical entity nodes in the control logic graph.

4. The industrial control system vulnerability hazard assessment method according to claim 1, characterized in that, The construction of a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on the multi-source heterogeneous data includes: The vulnerability node, the network asset node, and the physical entity node are constructed based on the multi-source heterogeneous data. Extracting operational semantics and network connectivity information from industrial control network traffic data based on deep packet inspection algorithm; Construct semantic edges between the network asset nodes and the physical entity nodes based on the operational semantics; Based on the network connection information, construct the communication edges between the network asset nodes and the dependency edges between the vulnerability node and the network asset node; The heterogeneous graph is constructed based on the vulnerability node, the network asset node, the physical entity node, the semantic edge, the communication edge, and the dependency edge; The heterogeneous graph includes the direct-connection damage-causing meta-path and the cascaded transmission meta-path, which are composed of the vulnerability node, the network asset node, the physical entity node and the edge sequence and are used to define risk transmission rules. The edge sequence includes at least one of the semantic edge, the communication edge and the dependency edge.

5. The industrial control system vulnerability hazard assessment method according to claim 4, characterized in that, The semantic edges include key control edges and sensitive read edges; the operational semantics include write operation primitives and read operation primitives; The construction of semantic edges between network asset nodes and physical entity nodes based on operational semantics includes: If the operation semantics is the write operation class primitive and the security value component corresponding to the physical entity node is higher than a preset threshold, then a critical control edge is constructed. If the operation semantics are the read operation primitives and the confidential value component corresponding to the physical entity node is higher than a preset threshold, then a sensitive read edge is constructed.

6. The industrial control system vulnerability hazard assessment method according to claim 4, characterized in that, The direct-connection damage-causing meta-path includes security breach path, confidentiality leakage path, and service interruption path; the cascading transmission meta-path includes cross-domain penetration path. The security breach path passes through the vulnerability node, network asset node, and physical entity node in sequence, with the vulnerability node and network asset node connected by a dependency edge, and the network asset node and physical entity node connected by a semantic edge. The confidentiality leakage path passes through the vulnerability node, network asset node and physical entity node in sequence, and the vulnerability node and network asset node are connected by a dependency edge, and the network asset node and physical entity node are connected by a sensitive read edge. The service interruption path passes through the vulnerability node, the first network asset node, and the second network asset node in sequence. The vulnerability node and the first network asset node are connected by a dependency edge, and the first network asset node and the second network asset node are connected by a communication edge. The cross-domain penetration path sequentially passes through the first vulnerability node, the first network asset node, the second network asset node, and the second vulnerability node. The first vulnerability node and the first network asset node are connected by a dependency edge, the first network asset node and the second network asset node are connected by a communication edge, and the second network asset node and the second vulnerability node are connected by a dependency edge.

7. The industrial control system vulnerability hazard assessment method according to any one of claims 1 to 6, characterized in that, The cascaded transmission meta-path includes cross-domain penetration paths; The method of extracting the cascading hazard propagation path of a vulnerability among the vulnerable node, the network asset node, and the physical entity node by utilizing direct-connection damaging meta-paths and cascading propagation meta-paths includes: Generate an adjacency tensor of a preset dimension based on the heterogeneous graph; Extract the first channel slice corresponding to the dependent edge, the second channel slice corresponding to the key control edge, the third channel slice corresponding to the sensitive read edge, and the fourth channel slice corresponding to the communication edge from the adjacency tensor; A path instance matrix of security breach paths is generated based on the first channel slice and the second channel slice; A path instance matrix of confidential leakage paths is generated based on the first channel slice and the third channel slice; A path instance matrix of service interruption paths is generated based on the first channel slice and the fourth channel slice; The path instance matrix of the service interruption path contained in the direct connection damage element path and the path instance matrix of the cross-domain penetration path generated by the transposed first channel slice are used. Extract the unique node identifiers corresponding to the vulnerability node, the network asset node, and the physical entity node from all path instance matrices, and construct a node connection order identifier sequence based on the unique node identifiers; The cascading hazard propagation path is generated based on the node connection sequence identifier.

8. The industrial control system vulnerability hazard assessment method according to claim 2, characterized in that, Using an attention mechanism with dynamic value bias, a node embedding vector fusing direct physical hazards and indirect cascading hazards is generated based on the cascading hazard propagation path, including: A dynamic value bias term is determined based on the generalized physical value vector of the neighboring nodes of any node in the cascading hazard propagation path, wherein any node and the neighboring node are any one of the vulnerability node, the network asset node and the physical entity node, respectively. Calculate the basic attention score between any node and its neighboring nodes; The basic attention score is weighted and amplified based on the dynamic value bias term; The projected features of the adjacent nodes are weighted and aggregated based on the weighted attention score to obtain the semantic embedding of the security breach path, the semantic embedding of the confidentiality leakage path, the semantic embedding of the business interruption path, and the semantic embedding of the cross-domain penetration path corresponding to any node. Semantic-level aggregation is performed on the semantic embeddings of the security breach path, the confidentiality leakage path, and the service interruption path to obtain direct connection path features; Semantic-level aggregation is performed on the semantic embedding of the cross-domain penetration path to obtain cascaded path features; By using an adaptive cascaded gating unit, the cascaded path features and the direct path features are residually fused to generate the node embedding vector that fuses direct physical hazards and indirect cascaded hazards.

9. The industrial control system vulnerability hazard assessment method according to claim 8, characterized in that, The multidimensional cascading hazard score includes a physical security cascading score, a confidentiality leakage cascading score, and a production interruption cascading score.

10. The industrial control system vulnerability hazard assessment method according to claim 1, characterized in that, The calculation of cascade gain value and hidden correlation influence factor based on the multidimensional cascade hazard score includes: The cascading gain value is determined based on the first difference between the comprehensive cascading hazard score after weighted fusion of multi-dimensional cascading hazard scores and the original basic vulnerability score. The hidden correlation influence factor is determined by the ratio of the second difference in the physical security cascade score recalculated after severing the correlation path between vulnerabilities to the actual physical security cascade score.

11. A device for assessing the risks of industrial control system vulnerabilities, characterized in that, include: The first construction module is used to construct a heterogeneous graph containing vulnerability nodes, network asset nodes, and physical entity nodes based on multi-source heterogeneous data of industrial control systems. The multi-source heterogeneous data includes network asset data, vulnerability knowledge base data, physical engineering data, and industrial control network traffic data. The extraction module is used to extract the cascading hazard propagation path of the vulnerability among the vulnerability node, the network asset node, and the physical entity node based on the heterogeneous graph and by using direct-connection damaging element paths and cascading propagation element paths. The generation module is used to generate a node embedding vector that integrates direct physical hazards and indirect cascading hazards based on the cascading hazard propagation path. The calculation module is used to generate a multi-dimensional cascaded hazard score based on the node embedding vector, and to calculate the cascaded gain value and hidden correlation influence factor based on the multi-dimensional cascaded hazard score; The output module is used to output the quantitative evaluation results of industrial control system vulnerabilities based on the cascaded gain value and the hidden correlation influence factor.

12. An electronic device, characterized in that, It includes a processor and a memory, the memory storing programs or instructions that can run on the processor, the programs or instructions being executed by the processor to implement the industrial control system vulnerability hazard assessment method as described in any one of claims 1-10.

13. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a computer, implement the industrial control system vulnerability hazard assessment method as described in any one of claims 1-10.

14. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when the computer program product is executed by a computer, it implements the industrial control system vulnerability hazard assessment method as described in any one of claims 1-10.

Images