Security optimization method, device and equipment based on capability curve and double strategy iteration

Abstract

The application relates to a security optimization method, device and equipment based on a capability curve and double strategy iteration, which comprises the following steps: performing a parameter table lookup operation according to enterprise classification grading information, obtaining a parameter boundary of an upper limit of capability and an inflection point input, deriving a capability demand based on input data of a predefined view architecture, performing maturity scoring on sub-dimensions of a technical view and a management view according to the capability demand and the parameter boundary, calculating a current comprehensive security capability through weighted geometric mean, switching between a strategy of making up an extremely low short board and a strategy of maximizing marginal benefit according to a current transformation interval and the lowest score in sub-dimension maturity scoring, generating an input allocation scheme, calculating a new comprehensive security capability according to re-evaluation data of sub-dimensions after input, superimposing a new data point on a historical data set to re-fit parameters of the input-capability transformation curve, and performing corresponding feedback or termination operation according to an iteration state.

Description

Technical Field

[0001] This application relates to the field of industrial internet technology, and in particular to a security optimization method, apparatus and equipment based on capability curves and dual-strategy iteration. Background Technology

[0002] The construction of industrial internet security is facing a critical stage of transformation from compliance-oriented to capability-oriented. As the digital transformation of industrial enterprises continues to deepen, the planning, construction, and continuous optimization of security capabilities have become core issues. In existing technical systems, static layered protection-type security architectures, represented by standards such as the IEC 62443 series, NIST SP 800-82 and cybersecurity frameworks, the Industrial Internet Consortium security framework, and the domestic "Industrial Internet Security Framework," generally adopt a protection approach based on security levels. They guide enterprises in deploying security measures by pre-defining the correspondence between protected objects and security functions. In practical applications, these frameworks rely on enterprise classification and grading information to determine the security construction level, but they can only provide a static configuration list of protection measures. They cannot explicitly map classification and grading information into quantitative parameters such as security capability limits and inflection point investments, nor can they deduce differentiated capability requirements based on specific enterprise assets, security objectives, and threat situations. Even if enterprises clearly understand their own classification and grading, they still face a lack of transformation from abstract levels to concrete investments, not knowing where to start or at what intensity to deploy which capabilities, resulting in a lack of an operational and quantitative starting point for the implementation of the framework. Therefore, how to parameterize enterprise classification and grading information into capability boundaries, and derive targeted capability requirements from multi-dimensional views such as objects, objectives, and risks, and construct a transformation path from qualitative levels to quantitative decisions, has become an urgent problem to be solved. Summary of the Invention

[0003] Based on this, this application provides a security optimization method based on capability curves and dual-policy iteration, characterized by comprising: Based on enterprise classification and grading information, perform parameter lookup operations to obtain the parameter boundaries of the capability upper limit and the inflection point investment, and deduce capability requirements based on the input data of the predefined view architecture. Based on the capability requirements and parameter boundaries, maturity scores are performed on the sub-dimensions of the technology view and management view, and the current comprehensive security capability is calculated by weighted geometric mean. At the same time, an investment-capability conversion curve is fitted based on the cumulative investment data and the current comprehensive security capability, and the conversion interval is determined. Based on the lowest score in the transformation interval and the maturity score of the sub-dimension, switch between the strategy of making up for the extremely low shortcomings and the strategy of maximizing marginal benefits to generate an investment allocation plan, and allocate the new investment to the corresponding sub-dimension according to the investment allocation plan to update the cumulative investment. The new comprehensive security capability is calculated based on the sub-dimensional reassessment data after the input, and the new data points are superimposed on the historical dataset to refit the parameters of the input-capability transformation curve. The corresponding feedback or termination operation is executed according to the iteration status.

[0004] Optionally, the step of performing a parameter lookup operation based on enterprise classification and grading information to obtain the parameter boundaries of the capability upper limit and the inflection point investment, and deriving capability requirements based on input data from a predefined view architecture, includes: Based on the enterprise classification and grading information, perform a parameter lookup operation to obtain the parameter boundaries of the capacity limit and the inflection point input; Based on the input data of the object view, target view, and risk view that constitute the predefined view architecture, a requirement derivation operation is performed to obtain a list of capability requirements for the functional view.

[0005] Optionally, the step of performing maturity scoring on the sub-dimensions of the technology view and management view based on the capability requirements and the parameter boundaries, calculating the current comprehensive security capability through a weighted geometric mean, and fitting an investment-capability conversion curve based on cumulative investment data and the current comprehensive security capability to determine the current conversion interval includes: Based on the capability requirements list, maturity scores are performed on each of the eleven sub-dimensions to obtain maturity scores for each of the eleven sub-dimensions. Based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, a weighted geometric mean is calculated to obtain the current comprehensive security capability; The weighted geometric mean calculation is assumed to be... For current comprehensive security capabilities, For the first Maturity score for individual dimensions For the first The weights corresponding to each sub-dimension and , By traversing the eleven sub-dimensions, the formula for calculating comprehensive security capability is as follows: ; Based on the cumulative investment data and the current comprehensive security capability, the parameters of the investment-capability conversion curve are fitted using a nonlinear least squares algorithm, and the current cumulative investment is substituted into the fitted investment-capability conversion curve to determine the current conversion interval. The input-capacity conversion curve is set as follows: Regarding cumulative investment Comprehensive security capabilities The upper limit of ability, The energy conversion rate coefficient. If the input level is the inflection point input level, then the input-capacity conversion curve equation is: .

[0006] Optionally, the step of switching between a strategy to address extremely low weaknesses and a strategy to maximize marginal benefits based on the lowest score in the transformation interval and the maturity score of the sub-dimension, generating an investment allocation scheme, and allocating the new investment to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment includes: Extract the lowest score from the eleven sub-dimensional maturity scores, and compare the lowest score with a preset extremely low shortcoming threshold. Based on the comparison between the lowest score and the extremely low weakness threshold, the priority investment direction is determined by switching between the strategy of addressing the extremely low weakness and the strategy of maximizing marginal benefits. Based on the priority investment direction, generate the current round investment allocation scheme, allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme, and update the cumulative investment.

[0007] Optionally, the step of calculating the new comprehensive security capability based on the reassessment data of the sub-dimensions after the investment, overlaying the new data points onto the historical dataset to refit the parameters of the investment-capability transformation curve, and performing corresponding feedback or termination operations according to the iteration status includes: After the investment, maturity scores are re-executed for each sub-dimensional, and a new comprehensive security capability is obtained by calculating a weighted geometric mean. The new data points, which include the updated cumulative investment and the new comprehensive security capabilities, are overlaid onto the historical dataset, and the parameters of the investment-capability conversion curve are refitted. Substitute the updated cumulative investment into the refitted investment-capability conversion curve, perform interval determination, and if the efficiency decline zone has not been entered, synchronize the newly discovered risks during the inspection process to the risk view through the process view and return to the maturity scoring step. If the efficiency decline zone has been entered, terminate the iteration and output the final comprehensive safety capability and the updated investment-capability conversion curve parameters.

[0008] Optionally, the step of switching between the strategy of addressing the extremely low shortcomings and the strategy of maximizing marginal benefits based on the comparison result between the lowest score and the extremely low shortcoming threshold, and determining the priority investment direction, includes: Based on the maturity scores of the eleven sub-dimensions, the lowest score is extracted and compared with the preset extremely low shortcoming threshold. When the lowest score is less than the extremely low weakness threshold, the sub-dimension corresponding to the lowest score is determined as the only priority investment direction in this round, and all new investments are allocated to the sub-dimension. When the lowest score is not less than the extremely low shortcoming threshold, calculate the marginal increment of comprehensive security capability after increasing the investment by one unit in each sub-dimension, and select the sub-dimension with the largest marginal increment of comprehensive security capability as the priority investment direction. The marginal increment of the comprehensive security capability is set as follows: For the first The marginal increase in comprehensive security capability resulting from increasing unit input in each sub-dimension, based on comprehensive security capability For investment The partial derivative calculation shows that the subdimension with the largest marginal increment is determined by... Sure.

[0009] Optionally, the step of overlaying new data points containing the updated cumulative investment and the new comprehensive security capabilities onto the historical dataset, and refitting the parameters of the investment-capability conversion curve, includes: The new data points, which include the updated cumulative investment and the new comprehensive security capabilities, will be overlaid onto the historical dataset. When the number of accumulated data points in the historical dataset is less than a preset threshold, the parameters of the input-capacity conversion curve are fitted using a Bayesian prior constraint with the industry average parameter as the mean. When the number of accumulated data points in the historical dataset is not less than the preset number threshold, the Levenberg-Marquardt algorithm is used to fit the parameters of the input-capacity conversion curve, and the variation range constraint is applied to the parameter values ​​obtained in this round of fitting. When the variation range of any parameter exceeds the preset proportion threshold, the parameter value of the previous round remains unchanged.

[0010] This application also provides a security optimization device based on capability curves and dual-policy iteration, the device comprising: The capability boundary and requirement derivation module is used to perform parameter lookup operations based on enterprise classification and grading information, obtain the parameter boundaries of capability upper limit and inflection point investment, and derive capability requirements based on input data of predefined view architecture. The security capability measurement and curve positioning module is used to perform maturity scoring on the sub-dimensions of the technology view and management view according to the capability requirements and the parameter boundaries, calculate the current comprehensive security capability through weighted geometric average, and fit the input-capability conversion curve based on the cumulative input data and the current comprehensive security capability to determine the conversion interval. The dual-strategy switching and investment allocation module is used to switch between the strategy of making up for extremely low shortcomings and the strategy of maximizing marginal benefits based on the lowest score in the conversion interval and the maturity score of the sub-dimension, generate an investment allocation scheme, and allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment. The reassessment, refitting, and iteration control module is used to calculate the new comprehensive security capability based on the reassessment data of the sub-dimensions after input, superimpose the new data points onto the historical dataset to refit the parameters of the input-capability transformation curve, and perform corresponding feedback or termination operations according to the iteration status.

[0011] Optionally, the safety capability measurement and curve localization module further includes: The sub-dimensional maturity scoring module is used to perform maturity scoring on the five sub-items of the technology view and the six sub-items of the management view according to the capability requirement list, and obtain eleven sub-dimensional maturity scores. The weighted geometric mean calculation module is used to perform weighted geometric mean calculation based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, to obtain the current comprehensive security capability; The curve fitting and interval determination module is used to fit the parameters of the input-capacity conversion curve using a nonlinear least squares algorithm based on the cumulative input data and the current comprehensive security capability, and to substitute the current cumulative input into the fitted input-capacity conversion curve to determine the current conversion interval.

[0012] This application also provides an electronic device, characterized in that it is used to implement any of the aforementioned security optimization methods based on capability curves and dual-policy iteration, comprising: The processor is used to execute the complete calculation and control process, from looking up enterprise classification and grading parameters, deriving view requirements, calculating sub-dimensional maturity scores and weighted geometric averages, fitting input-capability conversion curves and determining intervals, switching between dual strategies and generating input allocation schemes, re-evaluating and refitting, and iterative feedback termination operations. The memory is used to store the enterprise classification and grading parameter table, object view, target view, risk view input data, technology view and management view sub-dimension maturity scores, cumulative investment data, investment-capability conversion curve parameters, investment allocation scheme and final comprehensive security capability and curve parameters necessary to implement the complete process.

[0013] The beneficial effects of this application are as follows: Firstly, by determining the upper limit of capabilities and the inflection point investment boundary through parameter lookup based on enterprise classification and grading information, and deriving functional view requirements based on the inputs of the object view, target view, and risk view, a quantitative benchmark for differentiated security construction is achieved. Secondly, by adopting a weighted geometric average comprehensive security capability measurement and fitting a Logistic investment-capability transformation curve based on cumulative investment data, the nonlinear evolution law between security investment and security capability is explicitly depicted, thereby accurately determining the current transformation interval. Thirdly, by extracting the lowest score of sub-dimensions and comparing it with the extremely low weakness threshold, adaptive switching is achieved between strategies to address extremely low weaknesses and strategies to maximize marginal benefits, effectively depicting the structural constraints of multiple subsystems and targeting the weakest link's constraint on the overall security level. Fourthly, by overlaying newly reassessed data points after investment onto the historical dataset to refit curve parameters, and by performing risk feedback or terminating iteration based on the reassessment results, a closed-loop system of assessment, decision-making, execution, verification, and improvement is formed, supporting the continuous iterative evolution of security capabilities as the threat situation changes. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings required in the description of the embodiments or the prior art are briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0015] Figure 1 A flowchart illustrating a specific embodiment of the security optimization method based on capability curves and dual-policy iteration according to this application is shown. Figure 2 The diagram illustrates the architecture of a security optimization method based on capability curves and dual-policy iteration according to a specific embodiment of this application. Figure 3 This paper illustrates a specific embodiment of the security optimization method based on capability curves and dual-strategy iteration, showing the SERT input-capacity S-curve and a schematic diagram of three conversion zones. Figure 4 This paper illustrates a flowchart of the PDCA-SERT iterative optimization method based on capability curves and dual-policy iteration, according to a specific embodiment of the present application. Figure 5 This diagram illustrates a security optimization apparatus based on capability curves and dual-policy iteration according to a specific embodiment of this application. Detailed Implementation

[0016] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0017] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0018] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0019] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0020] This application proposes an industrial internet security capability optimization method based on capability curves and dual-strategy iteration to address key issues such as the inability of existing static layered protection frameworks and economic single-dimensional investment models to characterize the evolution of security capabilities, neglect of structural constraints of multi-subsystems, and lack of closed-loop iteration mechanisms. First, this method obtains the boundary conditions for capability upper limits and inflection point investments by looking up enterprise classification and grading parameters in a table. It then derives capability requirements based on a predefined view architecture including object views, target views, and risk views, laying a data foundation for differentiated implementation. Second, it scores the maturity of eleven sub-dimensions of the technology and management views, and calculates the current comprehensive security capability using a weighted geometric mean driven by threat exposure assessment. The geometric mean's penalty effect on low scores accurately captures the impact of the weakest link on the overall security level. Simultaneously, it combines cumulative investment data with a nonlinear least squares method to fit a Logistic-type investment-capability transformation curve, positioning the current security capability in the initial stage, high-efficiency transformation stage, or efficiency decline zone based on the curve parameters. During the investment allocation phase, a dual-strategy switching is performed based on the comparison between the lowest sub-dimensional score and the extremely low bottleneck threshold: if an extremely low bottleneck exists, targeted and concentrated investment is made to address it; otherwise, the allocation is based on the marginal increment of comprehensive security capability after increasing investment in each sub-dimensional, selecting the direction with the maximum gain, thus achieving dynamic optimal allocation of investment resources under structural constraints. After investment, maturity scores and weighted geometric averages are recalculated for each sub-dimensional. The updated cumulative investment and new comprehensive security capability data points are overlaid onto the historical dataset, and the investment-capability transformation curve parameters are refitted. Based on the re-determined interval, risk information feedback is performed, and the next iteration begins; or the iteration is terminated, and the final security capability and curve parameters are output. Through the above technical solution, this application establishes a complete iterative optimization system for quantitative assessment of security capabilities, nonlinear modeling of input and output, adaptive switching between the bottleneck and marginal benefit dual-strategy, and parameter closed-loop refitting, providing an operable engineering method for the continuous optimization of enterprise industrial internet security capabilities.

[0021] Example 1 like Figure 1 The diagram shown is a flowchart of a security optimization method based on capability curves and dual-policy iteration according to an embodiment of this application, specifically including the following: S100 performs a parameter lookup operation based on enterprise classification and grading information to obtain the parameter boundaries of the capability upper limit and the inflection point investment, and derives capability requirements based on the input data of the predefined view architecture.

[0022] Specifically, the initialization and requirement derivation for optimizing enterprise security capabilities are performed. First, based on a pre-defined enterprise classification and grading information table, the system uses parameter lookup to obtain the upper limit of security capabilities corresponding to each level and the inflection point investment amount corresponding to the inflection point of the investment-capability conversion curve. These two parameters constitute the hard boundary for subsequent quantitative analysis. After determining the parameter boundaries, the requirement derivation phase begins: using the object view, target view, and risk view in the predefined view architecture as input. The object view carries basic object information such as enterprise assets and network topology; the target view carries security objectives such as compliance requirements and protection levels; and the risk view carries threat exposure surface assessment and vulnerability scanning results. Based on the structured data of these three types of views, a capability requirement list for functional views is generated through requirement derivation logic mapping, clarifying the various security capabilities the enterprise needs to build at the current stage and their expected strength. The parameter boundaries and capability requirement list established in this step provide baseline data for subsequent maturity assessment, capability quantification, and investment decisions.

[0023] S200: Based on the capability requirements and the parameter boundaries, perform maturity scoring on the sub-dimensions of the technology view and management view, calculate the current comprehensive security capability using a weighted geometric mean, and simultaneously fit an investment-capability conversion curve based on the cumulative investment data and the current comprehensive security capability to determine the current conversion interval.

[0024] Specifically, this involves quantifying security capabilities and modeling the input-capability relationship. First, based on the capability requirements list generated by S100, maturity scores are assigned to eleven sub-dimensions across five sub-items in the technology view and six sub-items in the management view. Scoring can be done using pre-defined criteria or expert evaluation, yielding maturity scores for each sub-dimension. Next, the current overall security capability is calculated: weight coefficients for each sub-dimension are generated from the threat exposure assessment results in the risk view. These weights reflect the degree of emphasis the threat situation places on each sub-dimension. A weighted geometric mean formula is used to aggregate the maturity scores of the eleven sub-dimensions into a single overall security capability value. The low-score penalty characteristic of the geometric mean ensures that any weak sub-dimension significantly lowers the overall capability score. Next, the cumulative safety investment data of the enterprise before this stage is collected and paired with the current comprehensive safety capability to form data points. A nonlinear least squares algorithm is used to fit the parameters of the Logistic-type investment-capability conversion curve, obtaining parameters such as the capability conversion rate coefficient and the inflection point investment amount. Then, the current cumulative investment is substituted into the fitted curve function to calculate the relative position of the current capability value and the inflection point, thereby determining the current conversion interval: the initial stage, the high-efficiency conversion stage, or the efficiency decline zone. This step outputs the comprehensive safety capability value, curve parameters, and interval positioning results.

[0025] S300: Based on the lowest score in the transformation interval and the maturity score of the sub-dimension, switch between the strategy of making up for the extremely low shortcomings and the strategy of maximizing marginal benefits, generate an investment allocation scheme, and allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment.

[0026] Specifically, an investment allocation scheme is adaptively generated based on capability status and structural characteristics. First, the lowest score among the eleven sub-dimension maturity scores is extracted and compared with a preset threshold for extremely low weaknesses. If the lowest score is below this threshold, it indicates a significant weakness, triggering a strategy to address this extremely low weakness. The sub-dimension corresponding to the lowest score is designated as the sole priority investment direction for this round, with all new investments concentrated on this sub-dimension to eliminate the extreme weakness as quickly as possible. If the lowest score is not lower than the threshold, the strategy switches to maximizing marginal benefit: the marginal increment of comprehensive security capability caused by increasing investment by one unit in each sub-dimension is calculated. This marginal increment is obtained based on the partial derivative of comprehensive security capability with respect to the investment in each sub-dimension. The sub-dimension with the largest marginal increment is selected as the priority investment direction, maximizing the overall capability improvement with limited investment resources. After determining the priority investment direction, the investment allocation scheme for this round is generated, allocating the new investment amount to the selected sub-dimension and updating the cumulative investment records for that sub-dimension and the entire system. This step, through adaptive switching between two strategies, addresses both the urgent vulnerability and the pursuit of efficiency.

[0027] S400: Calculate the new comprehensive security capability based on the sub-dimensional reassessment data after the input, overlay the new data points onto the historical dataset to refit the parameters of the input-capability transformation curve, and execute the corresponding feedback or termination operation according to the iteration status.

[0028] Specifically, the process involves verifying the effectiveness of the investment, updating the model, and implementing iterative control. Based on the S300 allocation results, maturity scores are re-applied to each sub-dimension after the investment, and the new comprehensive security capability is calculated using a weighted geometric mean. The updated cumulative investment and the new comprehensive security capability are then overlaid onto the historical dataset to refit the parameters of the investment-capability transformation curve, reflecting the correction of the curve shape by the capability growth brought about by the latest investment. A stability control mechanism is introduced during the fitting process: when the number of historical data points is insufficient, a Bayesian prior constraint fitting with industry average parameters as the mean is used to prevent overfitting due to small samples; when the number of data points is sufficient, the Levenberg-Marquardt algorithm is used for fitting, and constraints are imposed on the variation of each parameter. If the variation of a parameter exceeds a preset proportional threshold, the previous parameter value is maintained to avoid curve distortion caused by noisy data. After refitting, the updated cumulative investment is substituted into the new curve to determine whether it has entered the efficiency decline zone. If it has not yet entered the stage, the newly discovered risks during this round of inspection will be synchronized to the risk view through the process view to form a closed-loop feedback of risk information, and then return to the maturity scoring step to continue the next round of iteration; if it has entered the efficiency reduction zone, it indicates that the marginal benefits have decreased significantly, the iteration process will be terminated, and the final comprehensive security capability and the final input-capability conversion curve parameters will be output as a quantitative summary of the security construction capability at this stage.

[0029] In summary, this application breaks through the limitations of the traditional static layered protection and single-dimensional economic investment model, proposing a closed-loop optimization method for industrial internet security capabilities based on capability curves and dual-strategy iteration. First, by constructing a demand derivation mechanism with parameterized boundaries and a predefined view architecture, enterprise classification and grading information is explicitly mapped to quantitative benchmarks such as capability upper limits and inflection point investments. Based on structured inputs from object views, target views, and risk views, a capability requirement list is generated, providing a transformation path from qualitative compliance to quantitative decision-making for differentiated security construction. Second, a security capability measurement system with a weighted geometric average as its core and a fitting and positioning method for the Logistic-type investment-capability transformation curve are established. The geometric average's penalty effect on low scores captures the constraints of weak links on the overall capability level. Simultaneously, nonlinear fitting characterizes the nonlinear evolution law between security investment and security capabilities: slow growth in the initial stage, rapid increase in the efficient transformation stage, and declining marginal returns in the efficiency reduction zone. This achieves accurate quantification of security capabilities and accurate determination of the current transformation interval. Finally, a dual-strategy adaptive switching allocation mechanism that addresses extremely low-level weaknesses and maximizes marginal benefits, along with an iterative control loop for parameter closed-loop refitting, was constructed. This mechanism achieves targeted elimination of extreme fragility by extracting the lowest sub-dimension score and comparing it with a threshold, optimizes the allocation of limited resources by calculating the marginal increment of each sub-dimension, and refits curve parameters by overlaying post-investment reassessment data with historical datasets and applying prior constraints and variation range constraints. This forms a complete closed-loop system encompassing evaluation, decision-making, execution, verification, and improvement, supporting the continuous iterative evolution of security capabilities as the threat landscape changes. This provides an operable engineering method for the continuous optimization of enterprise industrial internet security capabilities.

[0030] As an optional implementation of this application, optionally, in step S100, a parameter lookup operation is performed based on the enterprise classification and grading information to obtain the parameter boundaries of the capability upper limit and the inflection point input, and the capability requirements are deduced based on the input data of the predefined view architecture, including: 110. Based on the enterprise classification and grading information, perform a parameter lookup operation to obtain the parameter boundaries of the capacity limit and the inflection point input.

[0031] Specifically, the system maps enterprise classification and grading information to quantitative parameter boundaries. A pre-defined enterprise classification and grading parameter table is used as an index, indexed by classification and grading dimensions such as industry type, business scale level, and security protection level, storing the upper limit of capabilities corresponding to each classification and grading combination. With the inflection point input Two key parameters. After receiving enterprise classification and grading information, the system extracts the industry type identifier, scale level identifier, and security level identifier, combines them into a lookup table key value, performs an exact match query in the parameter table, and retrieves the corresponding capability limit and inflection point input parameters. Among these, the capability limit... This represents the theoretical upper limit of a company's security capabilities at this level under current technological conditions, and the inflection point investment. This indicates the inflection point on the input-capability conversion curve where marginal returns change from increasing to decreasing. For example, a medium-sized manufacturing enterprise is rated as Level 3 Industrial Internet security protection. Looking up the table, its capability ceiling is 0.92, and the inflection point investment is 3.8 million yuan. These two parameter boundaries constitute the upper limit constraint and decision-making benchmark for all subsequent quantitative analyses, ensuring that enterprises of different sizes and with different compliance requirements have differentiated evaluation scales tailored to their own realities.

[0032] 120. Based on the input data of the object view, target view, and risk view that constitute the predefined view architecture, perform a requirement derivation operation to obtain a list of capability requirements for the functional view.

[0033] Specifically, security capability requirements are derived based on three types of input views within a predefined view architecture. This predefined view architecture includes object views, target views, and risk views. Figure 3 The system comprises three main components. The object view contains structured data such as an enterprise asset inventory, network topology nodes, data flow relationships, and device configuration information, describing the set of objects requiring protection. The target view contains a formalized description of security objectives, including legal and regulatory compliance clauses, industry security standards, and enterprise security policies, expressing the security state the enterprise should achieve. The risk view contains structured records of risk information, such as threat intelligence, vulnerability scan results, and attack surface exposure assessments, reflecting the current threat landscape faced by the enterprise. The input data from these three views are jointly analyzed, and predefined requirement derivation rules are used to cross-map the asset importance level of the object view, the protection requirement level of the target view, and the threat severity of the risk view, generating a capability requirement list for the functional view. For example, when the risk view shows a high exposure of a certain industrial protocol port, combined with the accessibility requirements for the network area containing that protocol in the target view, the requirement for protocol deep packet inspection capability is derived and prioritized. This list clarifies the types and expected strength of security capabilities required by the enterprise at the current stage, providing an assessment object set for subsequent maturity assessments.

[0034] As an optional implementation of this application, optionally, in step S200, maturity scores are performed on the sub-dimensions of the technology view and management view based on the capability requirements and the parameter boundaries, and the current comprehensive security capability is calculated using a weighted geometric mean. Simultaneously, an input-capability conversion curve is fitted based on the cumulative input data and the current comprehensive security capability, and the current conversion interval is determined, including: 210. Based on the capability requirements list, perform maturity scoring on each of the eleven sub-dimensions to obtain maturity scores for each of the eleven sub-dimensions.

[0035] Specifically, complete the independent maturity assessment for each sub-dimensional. Based on the security capability types covered by the capability requirement list generated in step 120, perform maturity scoring on each of the eleven sub-dimensionalities: five sub-dimensional dimensions in the technology view and six sub-dimensional dimensions in the management view. The five sub-dimensional dimensions in the technology view cover network security protection, host security protection, application security protection, data security protection, and cloud security protection. The six sub-dimensional dimensions in the management view cover security policy management, organizational responsibility management, personnel capability management, security operations management, compliance audit management, and supply chain security management. A unified maturity level model is used for scoring each sub-dimensional, dividing each capability into several levels from zero to full. Each level defines clear technical implementation standards or management implementation standards. The assessment process can be based on the results of automated testing tools, findings in security audit reports, or professional judgments made by security experts against the scoring standards. For example, the data security protection sub-dimensional can be assessed item by item from dimensions such as data classification and grading coverage, encrypted storage implementation rate, and data flow audit integrity, and then a comprehensive score is derived. The score range can be set between zero and one, ultimately yielding the maturity scores for each of the eleven sub-dimensionalities, which serve as input for the comprehensive capability calculation.

[0036] 220. Based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, a weighted geometric mean is calculated to obtain the current comprehensive security capability.

[0037] Specifically, a weighted geometric average is used to aggregate the scores of the multi-dimensional sub-dimensions into a single comprehensive security capability value. The weights of each sub-dimension are driven by the threat exposure assessment results of the risk view: sub-dimensions with higher threat exposure are assigned greater weights to reflect a risk-oriented measurement preference. Let... For current comprehensive security capabilities, For the first Maturity scores for each sub-dimension, with values ​​ranging from 0 to 1. For the first The weights corresponding to each sub-dimension and satisfying , Traversing all eleven sub-dimensions, the formula for calculating comprehensive security capability is as follows: The reason for using the geometric mean instead of the arithmetic mean lies in its low-score penalty effect: when the score of any sub-dimension approaches zero, the overall comprehensive security capability score also approaches zero. This characteristic ensures that the scoring result will not mask a serious weakness in a particular sub-dimension due to the good performance of other sub-dimensions. For example, even if all ten sub-dimensions score at a high level of 0.9, if the score of the remaining sub-dimension is only 0.2, the arithmetic mean can still give a relatively high score of 0.83, while the weighted geometric mean will significantly lower the score to a level far below that, with the low score producing a significant penalty effect. This aggregation method mathematically forces security construction to ensure systematic balance; any weakness in an extremely low sub-dimension cannot be compensated for by other strengths.

[0038] 230. Based on the cumulative investment data and the current comprehensive security capability, the parameters of the investment-capability conversion curve are fitted using a nonlinear least squares algorithm, and the current cumulative investment is substituted into the fitted investment-capability conversion curve to determine the conversion interval.

[0039] Specifically, a quantitative relationship model between input and capability is established, and the current stage is identified. First, the cumulative security input data of the enterprise since the start of this security construction stage is collected. This cumulative security input includes direct security expenditures such as security equipment procurement costs, security service renewal fees, and security personnel costs. The cumulative input data and the current comprehensive security capability calculated in step 220 are combined to form a data point. As iterations progress, several data points will accumulate in the historical dataset. A nonlinear least squares algorithm is used to fit the parameters of the Logistic input-capability conversion curve. The equation of this curve is... ,in Regarding cumulative investment Comprehensive security capabilities The upper limit of the ability obtained in step 110. The energy conversion rate coefficient. This represents the input amount at the inflection point. The fitting process aims to minimize the sum of squared errors from all data points to the curve, optimizing the solution. and Two parameters. After the fit converges, a complete curve expression is obtained. Substitute the current cumulative investment value into the fitted curve, calculate the corresponding capacity value, and compare the cumulative investment value with the inflection point investment amount. In comparison, if the cumulative investment is much smaller This is the initial stage, where the capacity growth per unit of investment is relatively limited; if the cumulative investment is... The vicinity is in a period of high-efficiency conversion, at which point the marginal return on investment reaches its peak; if the cumulative investment is much greater than This indicates that the system is in the diminishing efficiency zone, meaning its capabilities are nearing their maximum. The marginal returns from continued investment decrease significantly. This positioning result provides a basis for decision-making regarding subsequent investment strategies.

[0040] As an optional implementation of this application, optionally, in step S300, based on the lowest score in the transformation interval and the maturity score of the sub-dimension, a strategy for addressing extremely low shortcomings and a strategy for maximizing marginal benefits are switched to generate an investment allocation scheme, and the new investment is allocated to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment, including: 310. Extract the lowest score from the eleven sub-dimensional maturity scores and compare the lowest score with a preset extremely low shortcoming threshold.

[0041] Specifically, the system identifies the most critical weak points in the current security capability structure. From the eleven sub-dimensional maturity scores obtained in step 210, the system iterates through and compares all scores, extracting the lowest score. The most critical weak point threshold is a preset maturity threshold used to define whether a sub-dimensional has become a serious drag on the entire security system. This threshold is set based on industry experience data and risk assessment methodologies, and is typically taken in the lower range of the maturity metric; for example, in the score range of zero to one, the threshold can be preset to 0.3. After extracting the lowest score, the system compares this score with the most critical weak point threshold, outputting the comparison result: the lowest score is below the threshold, or the lowest score is not below the threshold. This comparison result directly determines the strategy selection path in step 320.

[0042] 320. Based on the comparison result between the lowest score and the extremely low weakness threshold, switch between the strategy of making up for the extremely low weakness and the strategy of maximizing marginal benefits to determine the priority investment direction.

[0043] Specifically, an adaptive selection is made between the two investment strategies based on the comparison results of step 310. When step 310 determines that the lowest score is less than the extremely low vulnerability threshold, the strategy of addressing the extremely low vulnerability is triggered: the sub-dimension corresponding to the lowest score is determined as the sole priority investment direction for this iteration, and all newly added investment resources are concentrated on this sub-dimension to eliminate the extremely vulnerable links in the security system in the most direct way. When step 310 determines that the lowest score is not lower than the extremely low vulnerability threshold, it indicates that there is no extreme vulnerability, and the system switches to the marginal benefit maximization strategy: the marginal increment of comprehensive security capability caused by increasing investment by one unit in each sub-dimension is calculated, and the sub-dimension with the largest marginal increment is selected as the priority investment direction. Let... For the first The marginal increase in comprehensive security capability resulting from increasing unit input in each sub-dimension, based on comprehensive security capability For investment The partial derivative calculation shows that the subdimension with the largest marginal increment is determined by... Confirmed. The calculation of this partial derivative depends on the marginal benefit relationship revealed by the input-capacity conversion curve fitted in step 230, and the elasticity of the contribution of each sub-dimensional maturity score to the overall capability. The switching mechanism of the two strategies essentially unifies the goals of emergency response and optimized development in security construction: the strategy of addressing shortcomings ensures the bottom line, while the marginal benefit strategy pursues efficiency.

[0044] 330. Generate the current round investment allocation scheme according to the priority investment direction, allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme, and update the cumulative investment.

[0045] Specifically, the strategic decisions are translated into executable investment allocation plans and implemented. Once the priority investment direction is determined in step 320, the system generates an investment allocation plan for this round based on that priority. The investment allocation plan consists of data entries containing target sub-dimension identifiers and corresponding allocation amounts. When implementing the strategy of addressing extremely low weaknesses, the investment allocation plan contains only one entry for the sub-dimension identified as an extremely low weakness, and the total amount of new investment in this round is allocated entirely to that sub-dimension entry. When implementing the marginal benefit maximization strategy, the entries for the priority investment direction sub-dimension in the investment allocation plan receive all new investment. The total amount of new investment can come from periodic allocations from the annual budget, phased security construction funds, or emergency investments triggered by security incidents. The system adds each investment amount in the investment allocation plan to the cumulative investment record of the corresponding sub-dimension and updates the total cumulative investment of the entire system. For example, if the new investment in a certain round is 500,000 yuan, and the priority investment direction is the network security protection sub-dimension, then the cumulative investment in the network security protection sub-dimension increases by 500,000 yuan, and the total cumulative investment of the system increases by the same amount. The updated cumulative investment data will be used as input for the re-evaluation in step 410.

[0046] As an optional implementation of this application, optionally, in step S400, a new comprehensive security capability is calculated based on the reassessed sub-dimension data after input, the new data points are superimposed onto the historical dataset to refit the parameters of the input-capability transformation curve, and corresponding feedback or termination operations are performed according to the iteration status, including: 410. After the investment, the maturity score of each sub-dimensional is re-executed, and the new comprehensive security capability is obtained by calculating the weighted geometric mean.

[0047] Specifically, the security status after the investment is reassessed. After the investment allocation and cumulative investment update are completed in step 330, the invested resources have been invested in the selected sub-dimensions, the corresponding security control measures have been strengthened, and the security capability status of the sub-dimension has changed. Other sub-dimensions may also change to some extent due to the linkage effect of the security system. The system re-performs maturity scoring for all eleven sub-dimensions, and the scoring standards and procedures are consistent with those in step 210. After obtaining the updated maturity scores of the eleven sub-dimensions, the new comprehensive security capability is calculated using the same weighted geometric mean formula as in step 220, with the weights still driven by the threat exposure assessment results of the risk view. The comprehensive security capability recalculated after the investment reflects the actual capability improvement effect brought about by this round of investment and forms a comparable data pair with the comprehensive security capability before investment.

[0048] 420. Add new data points containing the updated cumulative investment and the new comprehensive security capabilities to the historical dataset, and refit the parameters of the investment-capability conversion curve.

[0049] Specifically, the closed-loop update of the input-capacity conversion curve parameters is completed. The cumulative input updated in step 330 is used as the independent variable, and the new comprehensive security capability calculated in step 410 is used as the dependent variable, forming a new data point. This new data point is then superimposed onto the historical dataset storing historical iteration records. The historical dataset accumulates all cumulative input and comprehensive security capability data points generated in previous iterations. The system selects a fitting strategy based on the size of the current historical dataset. When the number of accumulated data points in the historical dataset is less than a preset threshold, the data points are too sparse, and direct fitting is prone to overfitting. In this case, a Bayesian prior constraint with the industry average parameter as the mean is used to fit the parameters of the input-capacity conversion curve. Industry experience values ​​are used as prior information to constrain the direction and range of parameter estimation, enhancing the fitting stability under small sample conditions. When the cumulative number of data points in the historical dataset is not less than a preset threshold, the data points are sufficient to support a reliable fit. The Levenberg-Marquardt algorithm is used to fit the parameters of the input-capacity conversion curve. After each round of fitting, a constraint is applied to the variation range of the fitted parameter values. If the variation range of any parameter exceeds a preset proportional threshold, the parameter value from the previous round is kept unchanged to prevent drastic jumps in the curve parameters caused by noisy data points or accidental fluctuations. This step gradually approximates and stabilizes the curve parameters in each iteration, making the input-capacity conversion curve increasingly accurate as actual data accumulates.

[0050] 430. Substitute the updated cumulative investment into the refitted investment-capacity conversion curve, perform interval determination, and if the efficiency decline zone has not been entered, synchronize the newly discovered risks during the inspection process to the risk view through the process view and return to the maturity scoring step. If the efficiency decline zone has been entered, terminate the iteration and output the final comprehensive safety capability and the updated investment-capacity conversion curve parameters.

[0051] Specifically, iterative decisions are made based on the updated model parameters. The cumulative investment updated in step 330 is substituted into the refitted investment-capability conversion curve from step 420. The corresponding capability value is calculated based on the curve equation and compared with the inflection point investment I_0 and the inflection area of ​​the curve to determine whether the current cumulative investment has entered the efficiency decline zone. When the curve position corresponding to the cumulative investment has not entered the efficiency decline zone, it indicates that the invested resources can still be effectively converted into capability improvement, and there is still reasonable room for continued investment in security construction. At this time, newly discovered risk information during this round of inspection is synchronized to the risk view via the process view: newly discovered risks include new threat types detected in this iteration cycle, newly exposed attack surfaces, and newly identified vulnerabilities in the security assessment. This risk information is written back to the risk view through the structured interface of the process view, providing information input for the risk view update and weight recalculation in the next iteration. Then the system returns to step 210 to start a new round of iteration. When the curve position corresponding to the cumulative investment has entered the efficiency decline zone, it indicates that the current capability is sufficiently close to the capability limit. Further investment yields very limited capacity gains, leading to a significant decrease in marginal returns. At this point, the system terminates the iteration process, outputting the final comprehensive security capability and the updated investment-capability conversion curve parameters, serving as the conclusive result of this stage of security capability development. The output final investment-capability conversion curve parameters include the capability conversion rate coefficient k, the inflection point investment amount I_0, and the capability upper limit. This characterizes the evolution of the enterprise's security capabilities under given conditions.

[0052] Example 2 As an application example of this application, the specific application is as follows: 1.1 System Composition and Overall Architecture The system described in this embodiment formally defines the industrial internet security ecosystem as a seven-tuple. This corresponds to seven view modules, forming a dual-track structure of "seven views + PDCA cycle" with the PDCA cycle. The view modules and their connections are as follows: Figure 2 As shown.

[0053] The seven view modules are organized according to the three-tiered WHAT-WHY-HOW structure of the system engineering, and the functions of each module are as follows: Object View (O) module: Defines the scope of protection of the security system, divides the protected objects into seven categories: device layer, control layer, network layer, platform layer, application layer, data layer and identifier resolution layer, and answers the question "What to protect"; The Goal View (G) module identifies the set of security characteristics to be achieved, including six core security goals: confidentiality, integrity, availability, reliability, non-repudiation, and resilience, answering the question "What needs to be achieved?" Risk View (R) Module: The system sorts out the threats, vulnerabilities and impacts of various protection objects, and uses a combination of the Common Vulnerability Scoring System (CVSS) basic score and industrial impact assessment to conduct risk assessment, answering "what threats are faced"; the assessment results directly determine the weight distribution of each sub-dimension in the subsequent security capability measurement; Functional View (F) Module: Defines the core security capability domains that the security system should possess, including identification and assessment, security protection, continuous monitoring, response and recovery, and auditing and tracing, answering the question "What capabilities are needed?" The Technology View (T) module describes the technical means required to implement each security function, including five sub-items: asset identification (T1), security monitoring (T2), security detection (T3), security protection (T4), and audit tracing (T5), answering the question "How to implement it technically?" The Management View (M) module defines the organizational and management elements that support the operation of the technology system. It includes six sub-items: organizational structure (M1), rules and procedures (M2), security personnel (M3), supply chain security (M4), security construction (M5), and security operation (M6), answering the question "How to manage and ensure security". Process view ( The module acts as the meta-orchestrator for the PDCA cycle, orchestrating the construction order, iteration rhythm, cycle, and termination conditions of the other six views. It does not bear any safety investment, nor does it enter the capability measurement formula. It answers the question of "how to implement and iteratively optimize in stages".

[0054] There are two types of directed relationships among the seven view modules mentioned above: Positive dependency The object view, target view, and risk view jointly drive the definition of capability requirements for the functional view. The functional view is then decomposed into specific implementation requirements for the technical view and management view, reflecting the "top-down design" logic. Feedback relationship The process view updates newly discovered risks to the risk view in each iteration's check step, ensuring that the risk view always reflects the latest threat situation. It also drives the adjustment of capability requirements for the next round of planning through R→F, forming a "bottom-up feedback" closed loop.

[0055] 1.2 Safety Capability Measurement Model (Weighted Geometric Mean) The system described in this embodiment uses a weighted geometric average to synthesize the enterprise's comprehensive security capabilities. Its calculation is shown in the following formula: Among them, the subscript j traverses the 5 sub-items (T1~T5) of the technical view and the 6 sub-items (M1~M6) of the management view, totaling 11 sub-dimensions that actually bear the security investment; Score the maturity level for the j-th sub-dimension; For the corresponding weights, and Weight The risk assessment results drive the determination of the sub-dimensions, with higher risk exposure resulting in greater weight. The four views—object, objective, risk, and function—are not included in this formula but serve as decision inputs during the planning phase.

[0056] The key advantage of using geometric mean instead of arithmetic mean lies in the fact that geometric mean inherently possesses the "weakest link effect": when the maturity level of any sub-dimension approaches zero, the overall security capability also approaches zero, thus mathematically accurately characterizing the safety engineering principle that "the weakest link determines the overall security level." It should be noted that the maturity scores for each sub-dimension... The specific evaluation method does not affect the core idea of ​​iterative optimization in this embodiment, as long as the score is within the acceptable range. It is acceptable as long as it is within the range and semantically consistent.

[0057] 1.3 Input-Capacity Nonlinear Transformation Model (Logistic S-curve) The system described in this embodiment uses the logistic growth model to characterize its comprehensive security capabilities. Regarding cumulative safety investment The nonlinear transformation law is shown in the following equation: in, The upper limit of the actual security capabilities that an enterprise can achieve under the current category and security level is determined by the enterprise's classification and grading results; This is the energy conversion rate coefficient; This represents the inflection point input level. The model divides the input-capacity conversion process into three stages: the inefficient conversion zone (…). ), high-efficiency conversion zone ( ) and the region of diminishing efficiency ( The three partitions and case iteration trajectories are as follows: Figure 3 As shown.

[0058] The technical basis for choosing the Logistic model is twofold: first, the S-shaped curve characteristic conforms to the law of diminishing marginal returns in safety investment; second, compared to more complex models, it only requires three parameters, and parameter estimation is more stable under small sample conditions. Its differential form... It has a clear meaning in safety engineering: This item represents the amplification effect of existing security capabilities on new investments (the better the security foundation of an enterprise, the higher the conversion efficiency of the same investment). The ceiling of a term's representational ability imposes constraints on further improvement (the closer it gets to the upper limit, the more difficult it becomes to improve marginally).

[0059] 1.4 PDCA-SERT Iterative Optimization Method Flow The method described in this embodiment is based on the aforementioned security capability measurement model and investment-capability transformation model, and drives the optimization of security investment through a PDCA iterative cycle. The complete process is as follows: Figure 4 As shown, the specific steps include: Step S1 (Classification and Grading, Determining the Boundary of the Optimization Space): Referring to the requirements for the classification and grading of industrial internet security, enterprises are divided into networked industrial enterprises (Category A), industrial internet platform enterprises (Category B), and identifier resolution enterprises (Category C), and further classified into Level 3 (L3), Level 2 (L2), and Level 1 (L1) according to their security levels from high to low; the corresponding level for each category is determined by referring to the table. and The parameter range serves as the boundary of the subsequent iterative optimization space.

[0060] Step S2 (Planning—Optimization based on the current fitted line): Read the inputs from the object view, target view, and risk view, and derive the capability requirements of the functional view; perform maturity scoring on 11 sub-dimensions (T1~T5, M1~M6), and calculate the current comprehensive security capability using a weighted geometric mean. In the first round, initial input-capacity data pairs were collected from the company, and multiple data pairs from comparable companies in the same industry were overlaid. The Levenberg-Marquardt algorithm was then used under constraints. , , The first round fits the Logistic parameters; subsequent rounds directly optimize based on the updated fitting parameters from the check step; based on the current cumulative investment... The fitted parameters determine its position within the S-curve.

[0061] Step S3 (Investment Priority Decision): Take the minimum value of the maturity scores of the 11 sub-dimensions. ;when Less than the preset extremely low bottleneck threshold When the structural integrity prerequisite is met, priority should be given to allocating resources to the sub-item with the lowest weakness (i.e., prioritizing the filling of structural defects); otherwise, based on the principle of maximizing marginal benefits, the sub-item that makes the most effective should be selected. The largest sub-item is the priority for investment.

[0062] Step S4 (Do Execution - Invest according to optimization results): Generate an investment allocation plan based on the priority determined in Step S3, and allocate the new investment in this round. Assign the security measures to the corresponding sub-items in the technical and management views and implement them accordingly, then update the cumulative security investment. .

[0063] Step S5 (Check – Reassessment and Curve Fit Update): Reassess the maturity of each sub-item and calculate the new overall safety capability using a weighted geometric mean. ; New data points By superimposing the results onto the historical dataset and refitting the Logistic parameters, we obtain... At the same time, newly discovered risks during the inspection process will be... The feedback path is synchronously updated to the risk view, so that it can be reread and its weights adjusted in the next round. .

[0064] Step S6 (Parameter Update Stability Constraint): To prevent drastic fluctuations in parameter estimation under small sample conditions, a constraint is imposed on parameter updates: if and only if , , Updates are only accepted when the changes in all three parameters do not exceed 20% of the previous estimate; when there are fewer than 8 accumulated data points, Bayesian prior constraints with the industry average parameter as the mean are preferred; when new data points cause a significant increase in the fitting residuals, data quality is checked first rather than directly updating the parameters.

[0065] Step S7 (Act Improvement—Position Determination and Next Round Start): ... Mapping onto the updated S-curve to determine the current interval: If it has not yet entered the efficiency decline zone, return to step S2 via the feedback loop, re-optimize based on the updated fitted line (at this time, the risk view has been synchronized with the latest risk); and determine whether re-grading is needed. If so, adjust the grade and re-determine the parameter range by looking up the table, then update the maturity of each sub-item and proceed to the next round. If it has already entered the efficiency decline zone ( If the iteration fails, the process will terminate and transition to refined security operations (consolidating current capabilities and enhancing system resilience). The iteration cycle is scheduled using the process view, with a recommended cycle of six months to one year for L3 enterprises and one to two years for L1 enterprises.

[0066] Step S8 (Output): Output the final comprehensive security capability. and the updated S-curve parameters This serves as a baseline for the company's security capability building achievements and the next planning cycle.

[0067] 1.5 Correspondence between security functions and key technologies In the implementation of step S4, the correspondence between each security functional domain and the key technical means that can be adopted is shown in Table 1. The technical selection prioritizes ensuring industrial real-time performance, compatibility with industrial proprietary protocols, and low false alarm rate.

[0068] Table 1 Correspondence between Safety Functions and Key Technologies 3.6 Example: Two rounds of iteration in a large steel enterprise Taking a large steel enterprise with an annual crude steel production of over 10 million tons, more than 8,000 networked PLCs and DCS devices, and a daily industrial data volume of over 50 TB as an example (classified as Class A L3), the key data for two rounds of PDCA iterations performed according to the method of this application are shown in Table 2.

[0069] Table 2 Comparison of key data from two rounds of PDCA iterations As shown in Table 2, the first round of the "addressing extremely weak links" strategy significantly improved M1 (organizational structure, 0.20 → 0.55) and M4 (supply chain security, 0.15 → 0.50), driving overall capability growth. The value increased from 0.34 to 0.53; the second round entered the high-efficiency conversion zone, with investment based on the principle of maximizing marginal benefits. The efficiency improved from 0.53 to 0.64, but the improvement rate narrowed significantly and approached the diminishing returns zone. In both iterations, the deviation between the predicted and actual values ​​of the Logistic model was controlled within 2%, validating the descriptive power and operability of this application in industrial safety scenarios.

[0070] Example 3 Based on the same principle as the aforementioned methods, a security optimization device based on capability curves and dual-policy iteration is also proposed, see [link to relevant documentation]. Figure 5 The security optimization apparatus 100 based on capability curves and dual-strategy iteration in this disclosure includes: The capability boundary and requirement derivation module 110 is used to perform parameter lookup operations based on enterprise classification and grading information, obtain the parameter boundaries of capability upper limit and inflection point investment, and derive capability requirements based on input data of predefined view architecture. The security capability measurement and curve positioning module 120 is used to perform maturity scoring on the sub-dimensions of the technology view and management view according to the capability requirements and the parameter boundaries, calculate the current comprehensive security capability by weighted geometric average, and fit the input-capability conversion curve based on the cumulative input data and the current comprehensive security capability to determine the conversion interval. The dual-strategy switching and investment allocation module 130 is used to switch between the strategy of making up for extremely low shortcomings and the strategy of maximizing marginal benefits based on the lowest score in the transformation interval and the maturity score of the sub-dimension, generate an investment allocation scheme, and allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment. The reassessment, refitting, and iteration control module 140 is used to calculate the new comprehensive security capability based on the sub-dimensional reassessment data after input, superimpose the new data points onto the historical dataset to refit the parameters of the input-capability transformation curve, and perform corresponding feedback or termination operations according to the iteration status.

[0071] Optionally, the safety capability measurement and curve positioning module 120 further includes: The sub-dimensional maturity scoring module 121 is used to perform maturity scoring on the five sub-items of the technology view and the six sub-items of the management view according to the capability requirement list, and obtain eleven sub-dimensional maturity scores. The weighted geometric mean calculation module 122 is used to perform weighted geometric mean calculation based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, to obtain the current comprehensive security capability. The curve fitting and interval determination module 123 is used to fit the parameters of the input-capacity conversion curve using a nonlinear least squares algorithm based on the cumulative input data and the current comprehensive security capability, and to substitute the current cumulative input into the fitted input-capacity conversion curve to determine the conversion interval.

[0072] Obviously, those skilled in the art should understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Therefore, this application is not limited to any specific hardware and software combination.

[0073] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0074] Example 4 Furthermore, an electronic device for implementing any of the described security optimization methods based on capability curves and dual-policy iteration includes: The processor is used to execute the complete calculation and control process, from looking up enterprise classification and grading parameters, deriving view requirements, calculating sub-dimensional maturity scores and weighted geometric averages, fitting input-capability conversion curves and determining intervals, switching between dual strategies and generating input allocation schemes, re-evaluating and refitting, and iterative feedback termination operations. The memory is used to store the enterprise classification and grading parameter table, object view, target view, risk view input data, technology view and management view sub-dimension maturity scores, cumulative investment data, investment-capability conversion curve parameters, investment allocation scheme and final comprehensive security capability and curve parameters necessary to implement the complete process.

[0075] The electronic device of this disclosure includes a processor and a memory for storing processor-executable instructions. The processor is configured to implement any of the aforementioned security optimization methods based on capability curves and dual-policy iteration when executing the executable instructions.

[0076] It should be noted that the number of processors can be one or more. Furthermore, the electronic device in this embodiment may also include input devices and output devices. The processor, memory, input devices, and output devices can be connected via a bus or other means, without specific limitations herein.

[0077] The memory, serving as a computer-readable storage medium for automated fault handling and self-learning methods in modules, can be used to store software programs, computer-executable programs, and various modules, such as the program or module corresponding to the security optimization method based on capability curves and dual-strategy iteration in this disclosure. The processor executes various functional applications and data processing of the electronic device by running the software programs or modules stored in the memory.

[0078] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A security optimization method based on capability curves and dual-policy iteration, characterized in that, include: Based on enterprise classification and grading information, perform parameter lookup operations to obtain the parameter boundaries of the capability upper limit and the inflection point investment, and deduce capability requirements based on the input data of the predefined view architecture. Based on the capability requirements and parameter boundaries, maturity scores are performed on the sub-dimensions of the technology view and management view, and the current comprehensive security capability is calculated by weighted geometric mean. At the same time, an investment-capability conversion curve is fitted based on the cumulative investment data and the current comprehensive security capability, and the conversion interval is determined. Based on the lowest score in the transformation interval and the maturity score of the sub-dimension, switch between the strategy of making up for the extremely low shortcomings and the strategy of maximizing marginal benefits to generate an investment allocation plan, and allocate the new investment to the corresponding sub-dimension according to the investment allocation plan to update the cumulative investment. The new comprehensive security capability is calculated based on the sub-dimensional reassessment data after the input, and the new data points are superimposed on the historical dataset to refit the parameters of the input-capability transformation curve. The corresponding feedback or termination operation is executed according to the iteration status.

2. The security optimization method based on capability curves and dual-strategy iteration as described in claim 1, characterized in that, The process of performing a parameter lookup operation based on enterprise classification and grading information to obtain the parameter boundaries of the capability upper limit and the inflection point investment, and deriving capability requirements based on input data from a predefined view architecture, includes: Based on the enterprise classification and grading information, perform a parameter lookup operation to obtain the parameter boundaries of the capacity limit and the inflection point input; Based on the input data of the object view, target view, and risk view that constitute the predefined view architecture, a requirement derivation operation is performed to obtain a list of capability requirements for the functional view.

3. The security optimization method based on capability curves and dual-strategy iteration as described in claim 1, characterized in that, The process involves performing maturity scoring on the sub-dimensions of the technology and management views based on the capability requirements and parameter boundaries, calculating the current comprehensive security capability using a weighted geometric mean, and simultaneously fitting an investment-capability conversion curve based on cumulative investment data and the current comprehensive security capability to determine the current conversion interval. This includes: Based on the capability requirements list, maturity scores are performed on each of the eleven sub-dimensions to obtain maturity scores for each of the eleven sub-dimensions. Based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, a weighted geometric mean is calculated to obtain the current comprehensive security capability; The weighted geometric mean calculation is assumed to be... For current comprehensive security capabilities, For the first Maturity score for individual dimensions For the first The weights corresponding to each sub-dimension and , By traversing the eleven sub-dimensions, the formula for calculating comprehensive security capability is as follows: ； Based on the cumulative investment data and the current comprehensive security capability, the parameters of the investment-capability conversion curve are fitted using a nonlinear least squares algorithm, and the current cumulative investment is substituted into the fitted investment-capability conversion curve to determine the current conversion interval. The input-capacity conversion curve is set as follows: Regarding cumulative investment Comprehensive security capabilities The upper limit of ability, The energy conversion rate coefficient. If the input level is the inflection point input level, then the input-capacity conversion curve equation is: 。 4. The security optimization method based on capability curves and dual-strategy iteration as described in claim 1, characterized in that, The step of switching between a strategy to address extremely low weaknesses and a strategy to maximize marginal benefits based on the lowest score in the transformation interval and the maturity score of the sub-dimension, generating an investment allocation scheme, and allocating new investments to the corresponding sub-dimensions according to the investment allocation scheme to update the cumulative investment includes: Extract the lowest score from the eleven sub-dimensional maturity scores, and compare the lowest score with a preset extremely low shortcoming threshold. Based on the comparison between the lowest score and the extremely low weakness threshold, the priority investment direction is determined by switching between the strategy of addressing the extremely low weakness and the strategy of maximizing marginal benefits. Based on the priority investment direction, generate the current round investment allocation scheme, allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme, and update the cumulative investment.

5. The security optimization method based on capability curves and dual-strategy iteration as described in claim 1, characterized in that, The process of calculating new comprehensive security capabilities based on the reassessment data of sub-dimensions after investment, overlaying the new data points onto the historical dataset to refit the parameters of the investment-capability transformation curve, and executing corresponding feedback or termination operations according to the iteration status includes: After the investment, maturity scores are re-executed for each sub-dimensional, and a new comprehensive security capability is obtained by calculating a weighted geometric mean. The new data points, which include the updated cumulative investment and the new comprehensive security capabilities, are overlaid onto the historical dataset, and the parameters of the investment-capability conversion curve are refitted. Substitute the updated cumulative investment into the refitted investment-capability conversion curve, perform interval determination, and if the efficiency decline zone has not been entered, synchronize the newly discovered risks during the inspection process to the risk view through the process view and return to the maturity scoring step. If the efficiency decline zone has been entered, terminate the iteration and output the final comprehensive safety capability and the updated investment-capability conversion curve parameters.

6. The security optimization method based on capability curves and dual-strategy iteration as described in claim 4, characterized in that, The step of switching between the strategy of addressing the extremely low shortcomings and the strategy of maximizing marginal benefits based on the comparison result between the lowest score and the extremely low shortcoming threshold, and determining the priority investment direction, includes: Based on the maturity scores of the eleven sub-dimensions, the lowest score is extracted and compared with the preset extremely low shortcoming threshold. When the lowest score is less than the extremely low weakness threshold, the sub-dimension corresponding to the lowest score is determined as the only priority investment direction in this round, and all new investments are allocated to the sub-dimension. When the lowest score is not less than the extremely low shortcoming threshold, calculate the marginal increment of comprehensive security capability after increasing the investment by one unit in each sub-dimension, and select the sub-dimension with the largest marginal increment of comprehensive security capability as the priority investment direction. The marginal increment of the comprehensive security capability is set as follows: For the first The marginal increase in comprehensive security capability resulting from increasing unit input in each sub-dimension, based on comprehensive security capability For investment The partial derivative calculation shows that the subdimension with the largest marginal increment is determined by... Sure.

7. The security optimization method based on capability curves and dual-strategy iteration as described in claim 5, characterized in that, The step of overlaying new data points containing the updated cumulative investment and the new comprehensive security capabilities onto the historical dataset, and refitting the parameters of the investment-capability conversion curve, includes: The new data points, which include the updated cumulative investment and the new comprehensive security capabilities, will be overlaid onto the historical dataset. When the number of accumulated data points in the historical dataset is less than a preset threshold, the parameters of the input-capacity conversion curve are fitted using a Bayesian prior constraint with the industry average parameter as the mean. When the number of accumulated data points in the historical dataset is not less than the preset number threshold, the Levenberg-Marquardt algorithm is used to fit the parameters of the input-capacity conversion curve, and the variation range constraint is applied to the parameter values ​​obtained in this round of fitting. When the variation range of any parameter exceeds the preset proportion threshold, the parameter value of the previous round remains unchanged.

8. A security optimization device based on capability curves and dual-strategy iteration, the device comprising: The capability boundary and requirement derivation module is used to perform parameter lookup operations based on enterprise classification and grading information, obtain the parameter boundaries of capability upper limit and inflection point investment, and derive capability requirements based on input data of predefined view architecture. The security capability measurement and curve positioning module is used to perform maturity scoring on the sub-dimensions of the technology view and management view according to the capability requirements and the parameter boundaries, calculate the current comprehensive security capability through weighted geometric average, and fit the input-capability conversion curve based on the cumulative input data and the current comprehensive security capability to determine the conversion interval. The dual-strategy switching and investment allocation module is used to switch between the strategy of making up for extremely low shortcomings and the strategy of maximizing marginal benefits based on the lowest score in the conversion interval and the maturity score of the sub-dimension, generate an investment allocation scheme, and allocate the new investment to the corresponding sub-dimension according to the investment allocation scheme to update the cumulative investment. The reassessment, refitting, and iteration control module is used to calculate the new comprehensive security capability based on the reassessment data of the sub-dimensions after input, superimpose the new data points onto the historical dataset to refit the parameters of the input-capability transformation curve, and perform corresponding feedback or termination operations according to the iteration status.

9. The security optimization device based on capability curves and dual-strategy iteration according to claim 8, wherein the security capability measurement and curve localization module further comprises: The sub-dimensional maturity scoring module is used to perform maturity scoring on the five sub-items of the technology view and the six sub-items of the management view according to the capability requirement list, and obtain eleven sub-dimensional maturity scores. The weighted geometric mean calculation module is used to perform weighted geometric mean calculation based on the maturity scores of the eleven sub-dimensions and the weights driven by the threat exposure assessment results of the risk view, to obtain the current comprehensive security capability; The curve fitting and interval determination module is used to fit the parameters of the input-capacity conversion curve using a nonlinear least squares algorithm based on the cumulative input data and the current comprehensive security capability, and to substitute the current cumulative input into the fitted input-capacity conversion curve to determine the current conversion interval.

10. An electronic device, characterized in that, The method for implementing the security optimization method based on capability curves and dual-policy iteration as described in any one of claims 1 to 7 includes: The processor is used to execute the complete calculation and control process, from looking up enterprise classification and grading parameters, deriving view requirements, calculating sub-dimensional maturity scores and weighted geometric averages, fitting input-capability conversion curves and determining intervals, switching between dual strategies and generating input allocation schemes, re-evaluating and refitting, and iterative feedback termination operations. The memory is used to store the enterprise classification and grading parameter table, object view, target view, risk view input data, technology view and management view sub-dimension maturity scores, cumulative investment data, investment-capability conversion curve parameters, investment allocation scheme and final comprehensive security capability and curve parameters necessary to implement the complete process.

Images