Smart city information system security hierarchical evaluation method

Abstract

The present application relates to big data and information system security evaluation technology in the field of electric digital data processing, and specifically discloses a smart city information system security hierarchical evaluation method. Information system asset attributes, network traffic and threat intelligence are collected, and a system dependence topology graph is constructed with systems as nodes and calling relations as directed edges; attack modes are mapped to the topology nodes, and a cascading failure threshold is calculated based on a load capacity coupling model; when a node fails, the failure load is transferred according to a load distribution strategy and the cascading failure scale is iteratively calculated; a risk propagation index is calculated in combination with single-point vulnerability scores and the cascading failure scale, and a security level is divided according to the index. The present application quantifies the cascading infection effect of the risk between systems, so that the hierarchical result reflects the global risk situation and overcomes the defects of static isolated scoring evaluation.

Description

Technical Field

[0001] This invention relates to big data and information system security assessment technology in the field of electronic digital data processing, and specifically discloses a method for security classification assessment of smart city information systems. Background Technology

[0002] Current security grading and evaluation methods for smart city information systems primarily rely on static compliance checks and single-point vulnerability scanning. The specific implementation involves: collecting asset attribute data of the information system at a specific point in time, comparing this data with a pre-set compliance policy baseline to obtain a compliance score; simultaneously running vulnerability scanning tools to acquire single-point vulnerability information, calculating a single-point vulnerability score based on general vulnerability scoring standards; and then weighting and summing the compliance score and the single-point vulnerability score to obtain a total security score, which is then divided into different security levels according to a fixed score range. This implementation treats the information system as an isolated entity for scoring and evaluation.

[0003] The aforementioned existing technologies treat information systems as isolated entities for static scoring and evaluation, failing to consider the complex dependencies formed by data flow and service calls in smart city information systems. When a single system is attacked and fails, the cascading amplification effect of risk due to load shifting in the system cluster cannot be quantified, resulting in security classification results that cannot reflect the true global risk situation. Summary of the Invention

[0004] The purpose of this invention is to provide a security classification and evaluation method for smart city information systems, which can solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: The security classification and evaluation methods for smart city information systems include: Collect asset attribute data, network traffic data, and external threat intelligence from smart city information systems; Based on the asset attribute data and the network traffic data, a system dependency topology graph is constructed with information systems as nodes and call relationships as directed edges; Map the attack patterns in the external threat intelligence to the topology nodes of the system-dependent topology graph; Based on the load capacity coupling model, the cascading failure threshold of the topology node is calculated according to the resource occupancy status of the topology node and the attack mode. When the topology node is attacked and the cascading failure threshold is reached, the failed load of the topology node is transferred to the adjacent topology node according to the preset load distribution strategy, and the cascading failure scale of the system-dependent topology graph is calculated iteratively. By combining the single-point vulnerability score of the topology node with the cascading failure scale, the risk propagation index of the information system corresponding to the topology node is calculated; The information system is classified into security levels based on the ranking threshold of the risk propagation index.

[0006] Preferably, the step of collecting asset attribute data, network traffic data, and external threat intelligence from the smart city information system, and constructing a system dependency topology graph with the information system as nodes and the call relationships as directed edges based on the asset attribute data and the network traffic data, includes: Extract the service instance identifier from the asset attribute data and the source Internet Protocol address and destination Internet Protocol address from the network traffic data; Session association is performed between the source Internet Protocol address and the destination Internet Protocol address to extract service message features during the session. The service instance identifier is mapped to a node in the system dependency topology graph, and the directed edge direction and edge weight between nodes are determined based on the call sequence and call frequency in the business message characteristics. Based on the nodes, the directed edge pointers, and the edge weights, a weighted directed system dependency topology graph is generated.

[0007] Preferably, mapping the attack patterns in the external threat intelligence to the topology nodes of the system-dependent topology graph includes: Analyze the external threat intelligence to extract the attack behavior sequence and its corresponding preconditions and consequences; The prerequisites are matched with the current running state of the topology nodes in the system dependency topology graph using Boolean matching to filter out target topology nodes that meet the prerequisites. The attack sequence is associated with the target topology node, and the damage type identifier of the attack sequence on the target topology node is determined based on the impact consequences; The initial vulnerability state of the target topology node is updated based on the damage type identifier, thus completing the mapping of the attack mode to the topology node.

[0008] Preferably, the calculation of the cascading failure threshold of the topology node based on the load capacity coupling model, according to the resource occupancy status of the topology node and the attack mode, includes: Collect the CPU utilization, memory utilization, and bandwidth utilization of the topology nodes within a preset time window, and calculate the overall load value; The initial capacity limit is determined based on the hardware configuration parameters of the topology nodes; The load capacity coupling model is used to calculate the difference between the initial capacity limit and the comprehensive load value to obtain the capacity margin. The capacity margin is reduced based on the destructive power coefficient corresponding to the attack mode, and the ratio of the reduced capacity margin to the comprehensive load value is determined as the cascading failure threshold of the topology node.

[0009] Preferably, the step of transferring the failed load of the topology node to adjacent topology nodes according to a preset load distribution strategy, and iteratively calculating the cascading failure scale of the system-dependent topology graph includes: When the current load of the topology node exceeds the cascading failure threshold, the topology node is marked as in a failed state, and its current load is determined as the failed load. Obtain the surviving neighboring nodes that are directly connected to the failed node through directed edges; The failed load is distributed to the surviving neighboring nodes according to the proportion of the weight of the directed edge to the total weight of all connected directed edges. Update the current load of the surviving adjacent nodes and re-determine whether the corresponding cascading failure threshold has been exceeded until no new failure nodes are generated. Count the final number of failure nodes as the cascading failure scale.

[0010] Preferably, the risk propagation index of the information system corresponding to the topology node is calculated by combining the single-point vulnerability score of the topology node with the cascading failure scale, and the security level of the information system is classified according to the ranking threshold of the risk propagation index, including: Obtain the vulnerability scan results corresponding to the topology node, and calculate the single-point vulnerability score based on the general vulnerability scoring system; Calculate the ratio of the cascading failure scale to the total number of nodes in the system dependency topology graph to obtain the risk diffusion ratio; The risk propagation index is generated by weighting and fusing the single-point vulnerability score with the risk diffusion ratio. The information systems are sorted in descending order of the risk propagation index, and then classified into different security levels based on the quantile cutoff value of the sorting position.

[0011] Preferably, after generating the weighted directed system dependency topology graph, the method further includes: Collect the latest network traffic data at fixed time intervals, and extract the current call sequence and current call frequency from the latest network traffic data; The current call frequency and the historical call frequency are exponentially smoothed to obtain a smoothed call frequency; Determine whether the smooth call frequency is lower than the preset business interaction lower limit threshold. If so, delete the corresponding directed edge in the system dependency topology graph. If not, the edge weight of the directed edge is updated to the normalized value of the smooth call frequency, and the directed edge pointer is updated based on the current call sequence to complete the dynamic reconstruction of the system dependency topology graph.

[0012] Preferably, updating the initial vulnerability state of the target topology node based on the damage type identifier to complete the mapping from the attack mode to the topology node further includes: When the same target topology node is mapped by multiple attack behavior sequences within the same time window, extract the damage type identifiers corresponding to the multiple attack behavior sequences. If there is a pre- or post-dependency relationship between the damage type identifiers, the damage type identifiers with pre-dependency relationships will be combined to generate a composite damage type identifier. The vulnerability state transition probability of the target topology node is adjusted according to the composite damage type identifier, and the composite damage type identifier and the vulnerability state transition probability are written into the node attributes of the system-dependent topology graph.

[0013] Preferably, the method of reducing the capacity margin based on the destructive power coefficient corresponding to the attack mode, and determining the ratio of the reduced capacity margin to the overall load value as the cascading failure threshold of the topology node further includes: Based on the resource consumption records of the attack mode in historical attack events, calculate the rate of change of the destructive power coefficient with the duration of the attack; The time-varying decay function of the destructive force coefficient is constructed based on the rate of change; The capacity margin is multiplied by the function value of the time-varying decay function at the current time to obtain the dynamically reduced capacity margin; Calculate the ratio of the dynamic capacity reduction margin to the overall load value, and use the ratio as the dynamic cascading failure threshold of the topology node at the current moment.

[0014] Preferably, distributing the failed load to the surviving neighboring nodes according to the proportion of the weight of the directed edge to the total weight of all connected directed edges further includes: Before allocating the failed load to the surviving neighboring nodes, calculate the sum of the current load and the pre-allocated load of the surviving neighboring nodes; Determine whether the accumulated value exceeds the capacity limit of the surviving neighboring nodes; If the load exceeds the limit, the pre-allocated load will be refused to be allocated to the surviving neighboring nodes, and the pre-allocated load will be marked as an overflow load. The overflow load is transferred to a secondary neighbor node connected to the surviving neighbor node. If the secondary neighbor node cannot bear the load, the overflow load is broadcast and discarded in the system dependency topology graph to prevent the unbounded spread of cascading failures.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By constructing a system dependency topology graph with information systems as nodes and call relationships as directed edges, attack patterns from external threat intelligence are mapped to topology nodes. Based on a load capacity coupling model, the cascading failure threshold of topology nodes is calculated. Then, when a topology node fails, the failed load is transferred according to a preset load distribution strategy, and the cascading failure scale of the system dependency topology graph is iteratively calculated. Finally, the risk propagation index is calculated by combining single-point vulnerability scores and cascading failure scale for ranking and classification. The system dependency relationships and risk cascading propagation mechanisms are incorporated into the classification calculation logic, quantifying the cascading failure scale caused by an attack on a single system in the system cluster. This allows the security classification results to reflect the contagion effect of risks in the system dependency topology and the global risk situation.

[0016] 2. By introducing a time-varying decay function with a destructive force coefficient to calculate the dynamic cascading failure threshold, the dynamic changes in resource consumption caused by attack behavior over time are adapted. During load allocation, when the sum of the current load of surviving adjacent nodes and the pre-allocated load exceeds the capacity limit, the overflow load is transferred to the next-level adjacent node or broadcast and discarded, thus preventing the unbounded spread of cascading failures. Based on exponential smoothing of call frequency and the lower limit threshold of business interaction, the system dependency topology is dynamically reconstructed, eliminating low-frequency noise connections. Multiple attack behavior sequences mapped to the same node are combined with pre- and post-dependencies to generate composite damage type identifiers, adjusting the vulnerability state transition probability. The above mechanisms constrain the boundary conditions and input accuracy of cascading failure scale calculation, reducing the interference of business cycle fluctuations and load overflow on the hierarchical results. Attached Figure Description

[0017] Figure 1 A flowchart outlining the overall methodology for security grading and evaluation of smart city information systems. Figure 2 This is a flowchart illustrating the process of building and dynamically refactoring the system dependency topology. Figure 3 Flowchart for mapping attack modes to topology nodes; Figure 4 Flowchart for calculating the failure threshold of cascaded topology nodes; Figure 5 Flowchart for iterative calculation of cascading failure scale; Figure 6 This is a flowchart for calculating the risk transmission index and classifying security levels. Detailed Implementation

[0018] The security classification and evaluation method for smart city information systems provided in this application can be applied to the security management platform of a smart city operation center. This platform can interact with various information systems in the smart city, including but not limited to government service systems, traffic management systems, energy management systems, healthcare systems, and education management systems. The security management platform collects operational data and external threat intelligence from various information systems, executes the security classification and evaluation method provided in this application, and outputs the security level classification results for each information system, providing a basis for formulating security protection strategies for smart city information systems.

[0019] Reference Appendix Figure 1 In one embodiment, the security management platform first collects asset attribute data, network traffic data, and external threat intelligence from the smart city information system. Asset attribute data can be obtained by connecting to the smart city asset database, which stores basic information about each information system, including system name, service instance identifier, deployment location, hardware configuration information, software version information, responsible department, and contact information. Network traffic data can be obtained through traffic acquisition devices deployed at the core network nodes of the smart city. These devices capture and parse all network data packets passing through the core network nodes, extracting information such as the source Internet Protocol address (IPA), destination IPA, source port, destination port, protocol type, data packet length, and timestamp. External threat intelligence can be obtained by subscribing to professional threat intelligence services. These service providers regularly push the latest attack event information, vulnerability information, malware characteristics, and attack behavior patterns.

[0020] Based on collected asset attribute data and network traffic data, the security management platform constructs a system dependency topology graph with information systems as nodes and call relationships as directed edges. This graph describes the business call relationships between various information systems in a smart city. Each node represents an independent information system, and the directed edges between nodes represent service call relationships between these systems. The direction of the directed edge indicates the call direction, and the weight of the edge indicates the frequency of the call.

[0021] The security management platform maps attack patterns from external threat intelligence to topology nodes in the system-dependent topology graph. An attack pattern refers to the specific methods and steps an attacker uses to exploit system vulnerabilities or security flaws to launch an attack; different attack patterns target different types of system vulnerabilities and operating environments. By mapping attack patterns to corresponding topology nodes, it's possible to identify which information systems might be targeted by specific attacks and the potential impact of such attacks on these systems.

[0022] The security management platform is based on a load-capacity coupling model, which calculates the cascading failure threshold of topology nodes based on their resource utilization status and attack patterns. The load-capacity coupling model describes the relationship between the load and capacity of an information system; when the load exceeds its capacity, the system will fail. The cascading failure threshold refers to the critical load value that causes the system to fail when attacked. This threshold is related to the current resource utilization status of the system and the destructive power of the attack pattern.

[0023] When a topology node is attacked and reaches the cascading failure threshold, the security management platform, according to a preset load distribution strategy, transfers the failed load of the topology node to adjacent topology nodes and iteratively calculates the cascading failure scale of the system-dependent topology graph. Cascading failure refers to the situation where, when one system fails, its original load is transferred to other adjacent systems, causing an increase in the load on those adjacent systems. When the load on these adjacent systems also exceeds their cascading failure threshold, they also fail. This failure propagates continuously through the system-dependent topology, forming a chain reaction. The cascading failure scale refers to the final number of systems that fail.

[0024] The security management platform combines the single-point vulnerability score of a topology node with the scale of cascading failures to calculate the risk propagation index of the information system corresponding to that topology node. The single-point vulnerability score measures the security vulnerability of an individual information system, primarily calculated based on the number and severity of vulnerabilities present in the system. The risk propagation index measures the potential global risk level that may result from an attack on a single information system; this index comprehensively considers both the system's own vulnerabilities and the propagation capability of risks within the system's dependent topology.

[0025] The security management platform classifies information systems into security levels based on a ranking threshold of the risk propagation index. This ranking threshold can be set according to the security needs and resource allocation of the smart city. By classifying information systems with higher risk propagation indices as having higher security levels, these systems can be prioritized for security hardening and protection, thereby improving the overall security level of the smart city.

[0026] Reference Appendix Figure 2 In one embodiment, the security management platform extracts the service instance identifier from the asset attribute data and the source Internet Protocol (IP) address and destination Internet Protocol (IP) address from the network traffic data. The service instance identifier is a unique identifier for a service process running in each information system, used to distinguish different service instances. The source IP address is the network address of the device sending the network data packet, and the destination IP address is the network address of the device receiving the network data packet.

[0027] The security management platform performs session association between the source and destination Internet Protocol (IP) addresses, extracting the characteristics of business packets during the session. Session association refers to grouping multiple data packets belonging to the same network session. A network session refers to a complete network communication process between two devices, typically composed of multiple data packets. Business packet characteristics include, but are not limited to, the protocol type, packet length, key fields in the packet content, request methods, and response status codes.

[0028] The security management platform maps service instance identifiers to nodes in the system dependency topology graph and determines the direction and weight of directed edges between nodes based on the call sequence and frequency in the business message characteristics. Call sequence refers to the chronological order in which service calls occur; analyzing the call sequence determines the direction of the service call, i.e., which system is the caller and which is the callee. Call frequency refers to the number of service calls between two systems within a preset time window; a higher call frequency indicates a tighter business dependency between the two systems.

[0029] The security management platform generates a weighted directed system dependency topology graph based on nodes, directed edge pointers, and edge weights. This weighted directed system dependency topology graph can more accurately reflect the strength and direction of business dependencies between various information systems in a smart city, providing a foundation for subsequent cascading failure analysis.

[0030] Reference Appendix Figure 3 In one embodiment, the security management platform parses external threat intelligence, extracting attack behavior sequences and their corresponding preconditions and consequences. An attack behavior sequence refers to a series of operational steps performed by an attacker when launching an attack, each step having a specific purpose and effect. Preconditions refer to the system state conditions that must be met for the attack to be successfully implemented, including the system's software version, open ports, running services, and existing vulnerabilities. Consequences refer to the damage caused to the system after a successful attack, including system performance degradation, data leakage, service interruption, and system paralysis.

[0031] The security management platform performs Boolean matching between the preconditions and the current running state of the topology nodes in the system dependency topology graph to filter out target topology nodes that meet the preconditions. Boolean matching means comparing each condition in the preconditions with the current running state of the topology node. When all conditions are met, the topology node is considered to meet the preconditions for an attack and may become a target.

[0032] The security management platform associates attack sequences with target topology nodes and determines the damage type identifier of the attack sequence on the target topology nodes based on the impact consequences. The damage type identifier is used to distinguish the types of damage caused to the system by different types of attacks, such as resource consumption damage, data leakage damage, service interruption damage, and system control damage.

[0033] The security management platform updates the initial vulnerability state of target topology nodes based on damage type identifiers, completing the mapping from attack patterns to topology nodes. The initial vulnerability state refers to the security vulnerability of a topology node before it is attacked. By mapping attack patterns to topology nodes and updating their vulnerability states, the security risks of topology nodes in the current threat environment can be more accurately assessed.

[0034] Reference Appendix Figure 4 In one embodiment, the security management platform collects the CPU utilization, memory utilization, and bandwidth utilization of topology nodes within a preset time window, and calculates the overall load value. CPU utilization refers to the proportion of time the CPU is used per unit of time; memory utilization refers to the ratio of the system's used memory capacity to the total memory capacity; and bandwidth utilization refers to the ratio of the system's used network bandwidth to the total network bandwidth. The overall load value is a weighted sum of these three indicators, used to measure the overall load of the system.

[0035] The security management platform determines the initial capacity limit based on the hardware configuration parameters of the topology nodes. The initial capacity limit refers to the maximum load that the system can bear under normal operating conditions. This value is related to the system's hardware configuration, including the number and clock speed of the central processing unit, memory capacity, network bandwidth, etc.

[0036] The security management platform uses a load-capacity coupling model to calculate the difference between the initial capacity limit and the overall load value to obtain the capacity margin. The capacity margin refers to the additional load that the system can currently withstand; the larger the capacity margin, the stronger the system's ability to withstand load surges.

[0037] The security management platform reduces the capacity margin based on the destructive power coefficient corresponding to the attack mode. The ratio of the reduced capacity margin to the overall load value is determined as the cascading failure threshold for the topology nodes. The destructive power coefficient measures the ability of different attack modes to consume system resources. The larger the destructive power coefficient, the more severe the attack on system resources, the greater the reduction in system capacity margin, and the lower the cascading failure threshold.

[0038] Reference Appendix Figure 5In one embodiment, when the current load of a topology node exceeds the cascading failure threshold, the security management platform marks the topology node as failed and determines its current load as failed load. Failed load refers to all the service load originally handled by the failed node, which needs to be transferred to other surviving nodes for continued processing.

[0039] The security management platform identifies surviving neighboring nodes that are directly connected to the failed node via directed edges. Surviving neighboring nodes are those that have a direct business call relationship with the failed node and are currently in normal operation.

[0040] The security management platform distributes failed load to surviving adjacent nodes according to the proportion of the weight of each directed edge to the total weight of all connected directed edges. The edge weight reflects the strength of the business dependency between two nodes. Distributing failed load according to the edge weight ratio makes the load distribution more consistent with the actual business call situation.

[0041] The security management platform updates the current load of surviving adjacent nodes and re-evaluates whether the corresponding cascading failure threshold has been exceeded, until no new failed nodes are generated. The final number of failed nodes is then counted as the cascading failure scale. By iteratively calculating the cascading failure scale, the potential global impact of a single node failure can be accurately assessed.

[0042] Reference Appendix Figure 6 In one embodiment, the security management platform obtains the vulnerability scan results corresponding to the topology nodes and calculates a single point of vulnerability score based on a general vulnerability scoring system. The general vulnerability scoring system is a standard method for assessing the severity of vulnerabilities. This system scores vulnerabilities from multiple dimensions, including attack vector, attack complexity, permission requirements, user interaction, scope of impact, confidentiality impact, integrity impact, and availability impact, ultimately yielding a score between 0 and 10, with higher scores indicating more severe vulnerabilities.

[0043] The security management platform calculates the risk diffusion ratio by dividing the scale of cascading failures by the total number of nodes in the system dependency topology. The risk diffusion ratio measures the extent to which risk spreads throughout the system dependency topology after a single node failure; a higher ratio indicates a wider range of risk diffusion.

[0044] The security management platform weights and integrates single-point vulnerability scores with risk propagation ratios to generate a risk propagation index. The weights of this weighting can be adjusted according to the security needs of smart cities, thus balancing the importance of system vulnerability and risk propagation capabilities in risk assessment.

[0045] The security management platform sorts information systems from highest to lowest risk propagation index and classifies them into different security levels based on the quantile cutoff value at each ranking position. The quantile cutoff value is the threshold used to divide the ranked risk propagation index sequence according to a certain proportion. For example, the top 10% of information systems are classified as Level 1 security, the next 20% as Level 2 security, and so on.

[0046] In one embodiment, after generating a weighted directed system dependency topology graph, the security management platform collects the latest network traffic data at fixed time intervals and extracts the current call sequence and current call frequency from the latest network traffic data. The fixed time interval can be set according to the frequency of change of smart city network traffic, for example, set to 1 hour, 6 hours, or 24 hours.

[0047] The security management platform exponentially smooths the current call frequency compared to historical call frequencies to obtain a smoothed call frequency. Exponential smoothing is a time series forecasting method that smooths out random fluctuations in data by weighted averaging of historical data, reflecting the long-term trend of the data.

[0048] The security management platform determines whether the frequency of smooth calls is lower than a preset lower threshold for business interactions. If so, it deletes the corresponding directed edges in the system dependency topology graph. The lower threshold for business interactions is used to distinguish between normal business call relationships and occasional, non-business network connections. Deleting low-frequency noisy connections can improve the accuracy of the system dependency topology graph.

[0049] If the smoothed call frequency is not lower than the preset lower threshold for business interactions, the security management platform updates the edge weights of directed edges to the normalized value of the smoothed call frequency and updates the directed edge pointers based on the current call sequence, thus completing the dynamic reconstruction of the system dependency topology graph. Normalization refers to mapping the smoothed call frequency to a numerical range between 0 and 1, making the edge weights of different directed edges comparable. By dynamically reconstructing the system dependency topology graph, changes in business dependencies between smart city information systems can be reflected in a timely manner.

[0050] In one embodiment, when the same target topology node is mapped by multiple attack behavior sequences within the same time window, the security management platform extracts the damage type identifiers corresponding to the multiple attack behavior sequences. The same time window refers to a short period of time, such as one hour, during which multiple attack behavior sequences simultaneously target the same target topology node.

[0051] The security management platform determines whether there are pre- or post-dependencies between damage type identifiers. If so, it combines damage type identifiers with pre- or post-dependencies to generate a composite damage type identifier. A pre- or post-dependency means that the successful execution of one attack depends on the successful execution of another attack. For example, an attacker may need to first obtain ordinary user privileges on the system before they can exploit a privilege escalation vulnerability to obtain administrator privileges.

[0052] The security management platform adjusts the vulnerability state transition probability of target topology nodes based on the composite damage type identifier, and writes the composite damage type identifier and vulnerability state transition probability into the node attributes of the system's dependent topology graph. The vulnerability state transition probability describes the probability that the system will transition from its current vulnerable state to a more severe vulnerable state when attacked. By adjusting the vulnerability state transition probability, the impact of multiple attack combinations on the system can be more accurately assessed.

[0053] In one embodiment, the security management platform calculates the rate of change of the destructive power coefficient with the duration of the attack based on the resource consumption records of the attack pattern in historical attack events. The resource consumption records in historical attack events include data such as the attack start time, attack end time, and the system's CPU utilization, memory utilization, and bandwidth utilization during the attack.

[0054] The security management platform constructs a time-varying decay function for the destructive power coefficient based on the rate of change. The time-varying decay function describes how the destructive power coefficient changes with the duration of the attack. Under normal circumstances, the destructive power of an attack will gradually decrease over time because the system will gradually adapt to the attack or take corresponding protective measures.

[0055] The security management platform multiplies the capacity margin by the value of the time-varying decay function at the current moment to obtain a dynamically reduced capacity margin. This dynamically reduced capacity margin more accurately reflects the impact of attacks on the system's capacity margin at different times.

[0056] The security management platform calculates the ratio of dynamically reduced capacity margin to the overall load value, and uses this ratio as the dynamic cascading failure threshold for topology nodes at the current moment. This dynamic cascading failure threshold adjusts dynamically with the duration of the attack, improving the accuracy of cascading failure analysis.

[0057] In one embodiment, before allocating failed load to surviving neighboring nodes, the security management platform calculates the sum of the current load of the surviving neighboring nodes and the pre-allocated load. The pre-allocated load refers to the load value that should be allocated to the surviving neighboring node, calculated according to the edge weight ratio.

[0058] The security management platform determines whether the accumulated value exceeds the capacity limit of surviving adjacent nodes. The capacity limit refers to the maximum load the system can bear; when the system load exceeds the capacity limit, the system will not be able to operate normally.

[0059] If the accumulated value exceeds the capacity limit of the surviving neighboring nodes, the security management platform will refuse to allocate pre-allocated load to that surviving neighboring node and mark the pre-allocated load as overflow load. Overflow load refers to the portion of the load that cannot be carried by the surviving neighboring nodes.

[0060] The security management platform transfers overflowing load to secondary neighbor nodes connected to surviving neighbor nodes. If a secondary neighbor node cannot handle the load, the overflowing load is broadcast and dropped across the system dependency topology graph to prevent the unbounded propagation of cascading failures. Broadcast dropping means that the overflowing load is evenly distributed to all surviving nodes in the system dependency topology graph, with each node bearing only a small portion of the load, thus avoiding the further propagation of cascading failures caused by the load being concentrated on a few nodes.

[0061] In one embodiment, the security management platform of the smart city operation center is deployed in a server cluster in the core computer room. This server cluster is connected to the core switch of the smart city and can collect all network traffic data flowing through the core switch. The security management platform also interfaces with the smart city asset database, vulnerability scanning system, and third-party threat intelligence service platform to regularly obtain asset attribute data, vulnerability scan results, and external threat intelligence.

[0062] The security management platform first performs data collection. The asset attribute data collection module obtains basic information about all registered information systems by calling the application programming interface of the smart city asset database, including the system's unique identifier, system name, service instance identifier list, deployment location, hardware configuration information, software version information, launch time, and responsible department. The service instance identifier list contains unique identifiers for all service processes running within the information system, with each service instance identifier corresponding to a specific business service.

[0063] The network traffic data acquisition module obtains copies of all network packets flowing through the core switch via a traffic mirroring port deployed on the core switch. The traffic acquisition device parses the captured packets, extracting the five-tuple information for each packet: source Internet Protocol address, source port, destination Internet Protocol address, destination port, and transport layer protocol type. It also extracts the packet's timestamp, packet length, and application layer protocol type. The traffic acquisition device stores the parsed traffic data in a structured format in a distributed time-series database for subsequent analysis.

[0064] The external threat intelligence gathering module obtains the latest threat intelligence data by calling the application programming interface (API) of a third-party threat intelligence service platform. Threat intelligence data includes, but is not limited to, the latest vulnerability information, malware hashes, malicious internet protocol addresses and domain names, attack behavior patterns, and attack organization information. The external threat intelligence gathering module standardizes the acquired threat intelligence data, converting different formats into a unified internal data format and storing it in the threat intelligence database.

[0065] The security management platform constructs a system dependency topology map based on collected asset attribute data and network traffic data. The topology map construction module first extracts all service instance identifiers from the asset attribute data and creates a corresponding topology node for each service instance identifier. Each topology node contains attributes such as a unique node identifier, node name, corresponding system unique identifier, service instance identifier, and node type.

[0066] The topology graph construction module reads network traffic data within a preset time window from a distributed time-series database. The preset time window is set to the past 24 hours. The module performs session association processing on the network traffic data, grouping data packets with the same source Internet Protocol address, source port, destination Internet Protocol address, destination port, and transport layer protocol type into the same network session. For each network session, the module extracts information such as the session's start time, end time, total number of data packets, total number of bytes, and application layer protocol type.

[0067] The topology graph construction module maps the source and destination Internet Protocol (IP) addresses of network sessions to corresponding service instance identifiers. Specifically, the topology graph construction module maintains a mapping table between IP addresses and service instance identifiers, generated using deployment location information and network configuration information from asset attribute data. When the source IP address of a network session corresponds to one service instance identifier, and the destination IP address corresponds to another service instance identifier, the topology graph construction module considers a service call relationship to exist between these two service instances.

[0068] The topology graph construction module counts the number of service calls between each pair of service instances within a preset time window, i.e., the call frequency. Simultaneously, the topology graph construction module determines the call sequence based on the start time of the network session, i.e., which service instance is the caller and which is the callee. The service instance identifier corresponding to the caller serves as the starting point of the directed edge, and the service instance identifier corresponding to the callee serves as the ending point of the directed edge.

[0069] The topology graph construction module normalizes the call frequency and uses it as the edge weight of the directed edges. The normalization formula is as follows: in, Indicates from node To the node The weight of the directed edge. This indicates that within a preset time window, from the node... To the node call frequency, This represents the maximum call frequency between all node pairs. Through normalization, the weights of all directed edges are mapped to a numerical range between 0 and 1, facilitating subsequent calculations and comparisons.

[0070] The topology graph construction module generates a weighted directed system dependency topology graph based on the created topology nodes, the determined directed edge directions, and the calculated edge weights. This topology graph is stored in the memory of the security management platform in the form of an adjacency matrix. Indicates from node To the node The weight of the directed edge, if there is no node To the node If there is a directed edge, then .

[0071] The security management platform maps attack patterns from external threat intelligence to topology nodes in the system's dependent topology graph. The attack pattern mapping module first reads the latest attack pattern data from the threat intelligence database. Each attack pattern data includes attributes such as a unique identifier for the attack pattern, the attack pattern name, the sequence of attack behaviors, a list of preconditions, and a list of impact consequences.

[0072] The attack pattern mapping module parses the list of preconditions for each attack pattern, converting them into Boolean expressions. For example, the preconditions for an SQL injection attack targeting a web application might include: the system is running Apache version 2.4.49, port 80 is open, the system uses a MySQL database, and the system has the CVE-2021-41773 vulnerability. These preconditions are concatenated using logical AND operators to form a Boolean expression.

[0073] The attack pattern mapping module traverses all topology nodes in the system dependency topology graph, matching the current running state of each topology node with the Boolean expression of the preconditions for the attack pattern. The current running state of a topology node includes information such as the software version of the system corresponding to the node, a list of open ports, a list of running services, and a list of existing vulnerabilities. This information is obtained through asset attribute data and vulnerability scanning results.

[0074] When the current operating state of a topology node satisfies the Boolean expression of the preconditions for an attack pattern, the attack pattern mapping module marks that topology node as a target topology node and associates the attack behavior sequence with that target topology node. The attack pattern mapping module determines the damage type identifier of the attack pattern on the target topology node based on the list of consequences of the attack pattern. For example, if the consequences of the attack pattern include 100% CPU utilization and system memory exhaustion, the damage type is identified as resource consumption damage; if the consequences of the attack pattern include sensitive data leakage, the damage type is identified as data leakage damage.

[0075] The attack pattern mapping module updates the initial vulnerability state of the target topology node based on the damage type identifier. The initial vulnerability state is represented by a numerical value ranging from 0 to 1, with higher values ​​indicating greater system vulnerability. Different damage type identifiers correspond to different vulnerability state increments; for example, resource-consuming damage corresponds to a vulnerability state increment of 0.2, data leakage damage to 0.3, and service interruption damage to 0.4. The attack pattern mapping module adds the corresponding vulnerability state increment to the initial vulnerability state of the target topology node to obtain the updated vulnerability state, thus completing the mapping from attack patterns to topology nodes.

[0076] The security management platform calculates the cascading failure threshold for topology nodes based on a load-capacity coupling model. The cascading failure threshold calculation module first collects the CPU utilization, memory utilization, and bandwidth utilization of each topology node within a preset time window. This data is obtained through a performance monitoring agent deployed on each information system server. The performance monitoring agent collects system performance data at a fixed sampling frequency and sends the data to the security management platform.

[0077] The cascading failure threshold calculation module calculates the overall load value for each topology node. The formula for calculating the overall load value is as follows: in, Represents a node The overall load value, Represents a node CPU utilization Represents a node memory usage Represents a node bandwidth utilization , , These are the weighting coefficients for CPU utilization, memory utilization, and bandwidth utilization, respectively, and they satisfy... In this embodiment, Set to 0.4. Set to 0.3. Set to 0.3.

[0078] The cascading failure threshold calculation module determines the initial capacity limit based on the hardware configuration parameters of the topology nodes. Initial capacity limit The value is set to 1 because CPU utilization, memory utilization, and bandwidth utilization are all expressed as proportions, ranging from 0 to 1. Therefore, the overall load value also ranges from 0 to 1.

[0079] The cascading failure threshold calculation module calculates the capacity margin for each topology node. The formula for calculating the capacity margin is as follows: in, Represents a node Capacity margin.

[0080] The cascading failure threshold calculation module reduces the capacity margin based on the destructive force coefficient corresponding to the attack mode. (Destructive force coefficient) The value ranges from 0 to 1. Different attack modes correspond to different destructive power coefficients. The larger the destructive power coefficient, the more severe the consumption of system resources by the attack. In this embodiment, the destructive power coefficient corresponding to resource consumption type damage is 0.8, the destructive power coefficient corresponding to data leakage type damage is 0.5, and the destructive power coefficient corresponding to service interruption type damage is 0.9.

[0081] The cascading failure threshold calculation module calculates the cascading failure threshold for topology nodes. The formula for calculating the cascading failure threshold is as follows: in, Represents a node The cascading failure threshold. When node When attacked, if the attack causes the node to... The increase in load exceeded Then the node It will fail.

[0082] The security management platform simulates attack scenarios on topology nodes and calculates the cascading failure scale of the system's topology graph. The cascading failure simulation module first selects a topology node as the initial attack node, increases the load on that node above its cascading failure threshold, causing the node to fail.

[0083] The cascaded failure simulation module determines the current load of the failed node as the failure load. The cascading failure simulation module obtains all surviving adjacent nodes directly connected to the failed node through directed edges. Surviving adjacent nodes are nodes that are not currently in a failed state.

[0084] The cascading failure simulation module calculates the failure load that should be allocated to each surviving adjacent node. The allocation ratio is determined according to the proportion of the weight of a directed edge to the total weight of all connected directed edges. Specifically, for failed nodes... The total weight of all its connected directed edges is ,in Represents nodes The set of directly connected surviving neighbors. Each surviving neighbor... The failure load to be allocated is: The cascading failure simulation module updates the current load of each surviving neighboring node, adding its current load to the assigned failure load. The module then re-evaluates whether the current load of each surviving neighboring node exceeds its cascading failure threshold. If it does, the node is marked as failed, and its current load is determined as the new failure load.

[0085] The cascading failure simulation module repeats the load distribution and failure judgment process described above until no new failed nodes are generated in the system dependency topology graph. The module then counts the final number of failed nodes, which is taken as the cascading failure scale corresponding to the initial attack node. .

[0086] The security management platform calculates the risk propagation index of the information system corresponding to each topology node. The risk propagation index calculation module first obtains the vulnerability scan results for each topology node, and then calculates the single-point vulnerability score based on a general vulnerability scoring system. The general vulnerability scoring system follows the CVSS 3.1 standard, scoring each vulnerability across eight dimensions: attack vector, attack complexity, privilege requirements, user interaction, impact scope, confidentiality impact, integrity impact, and availability impact. A base score is then calculated for each vulnerability. For nodes with multiple vulnerabilities, the single-point vulnerability score is the average of all base scores, normalized to a range of 0 to 1.

[0087] The risk propagation index calculation module calculates the risk diffusion ratio for each topology node. The formula for calculating the risk diffusion ratio is as follows: in, This represents the total number of nodes in the system's dependency topology graph.

[0088] The risk propagation index calculation module weights and merges single-point vulnerability scores with risk diffusion ratios to generate the risk propagation index. The formula for calculating the risk transmission index is as follows: in, This is the weighting coefficient for the single-point vulnerability score, with a value ranging from 0 to 1. In this embodiment, Set to 0.6.

[0089] The security management platform classifies information systems into security levels based on the risk propagation index. The security level classification module first sorts all information systems in descending order of risk propagation index. Then, based on the quantile cutoff value at each sorting position, the module classifies the information systems into four security levels: Level 1, Level 2, Level 3, and Level 4. The specific quantile cutoff values ​​are shown in Table 1 below. Table 1 Cutoff values ​​for security level classification in, The first in the risk transmission index ranking sequence Percentiles. For example, This indicates that 90% of information systems have a risk transmission index below this value.

[0090] The security level classification module assigns a corresponding security level to each information system based on the aforementioned quantile cutoff values ​​and generates a security classification assessment report. The security classification assessment report includes basic information about each information system, single-point vulnerability score, cascading failure scale, risk propagation index, security level, and security protection recommendations.

[0091] This embodiment constructs a system dependency topology graph, maps attack patterns to topology nodes, calculates cascading failure thresholds based on a load capacity coupling model, simulates the cascading failure process and calculates the cascading failure scale, and combines single-point vulnerability scores with cascading failure scales to calculate a risk propagation index for security level classification. It incorporates the dependencies between systems and the cascading risk propagation mechanism into the hierarchical calculation logic, quantifies the cascading failure scale triggered in the system cluster after a single system is attacked, and enables the security classification results to reflect the contagion effect of risks in the system dependency topology and the global risk situation.

[0092] In one embodiment, after generating a weighted directed system dependency topology graph, the security management platform performs a dynamic reconstruction operation of the system dependency topology graph. The dynamic topology graph reconstruction module collects the latest network traffic data at fixed time intervals, with the fixed time interval set to one hour. The module reads network traffic data from a distributed time-series database for the past hour and extracts the latest call sequence and current call frequency.

[0093] The topology graph dynamic reconstruction module performs exponential smoothing on the current call frequency and historical call frequencies to obtain a smoothed call frequency. The exponential smoothing process uses a single exponential smoothing method, and the calculation formula is as follows: in, Indicates at time From node To the node Smooth call frequency, Indicates at time From node To the node Current call frequency, Indicates at time From node To the node Smooth call frequency, This is a smoothing coefficient, with a value ranging from 0 to 1. In this embodiment, Set to 0.3.

[0094] The topology graph dynamic reconstruction module determines whether the smooth call frequency is lower than a preset business interaction lower limit threshold. The business interaction lower limit threshold is set to once per hour, meaning that if the smooth call frequency between two nodes is less than once per hour, it is considered that there is no stable business dependency relationship between the two nodes.

[0095] If the frequency of smooth calls falls below a preset threshold for business interactions, the dynamic topology graph reconstruction module deletes the corresponding directed edges in the system-dependent topology graph. After deleting the directed edges, the dynamic topology graph reconstruction module updates the adjacency matrix of the system-dependent topology graph, setting the corresponding adjacency matrix elements to 0.

[0096] If the smooth call frequency is not lower than the preset lower limit threshold for business interactions, the topology graph dynamic reconstruction module will update the edge weights of the directed edges to the normalized values ​​of the smooth call frequency. The normalization formula is the same as the formula in the above embodiment, that is: in, Indicates at time From node To the node The weight of the directed edge. Indicates at time Maximum smooth call frequency between all node pairs.

[0097] The topology graph dynamic reconstruction module also updates the directed edge pointers based on the current call sequence. If the latest network traffic data reveals that the call direction between two nodes has reversed (i.e., the original caller becomes the callee, and the original callee becomes the caller), the topology graph dynamic reconstruction module deletes the original directed edge and creates a new directed edge with the opposite direction to the original. The edge weight is the normalized value of the current smooth call frequency.

[0098] After completing the above operations, the dynamic topology reconstruction module generates an updated system dependency topology graph and stores it in the memory of the security management platform, replacing the original topology graph. By dynamically reconstructing the system dependency topology graph, changes in business dependencies between smart city information systems can be reflected in a timely manner, low-frequency noise connections can be eliminated, and the accuracy of subsequent cascading failure analysis can be improved.

[0099] In one embodiment, when mapping attack patterns to topology nodes, the security management platform handles situations where the same target topology node is mapped by multiple attack behavior sequences. The attack pattern mapping module maintains a time window, which is set to 1 hour. When multiple attack behavior sequences are mapped to the same target topology node within the same time window, the attack pattern mapping module extracts the damage type identifiers corresponding to these attack behavior sequences.

[0100] The attack pattern mapping module determines whether there are pre- or post-dependencies among these damage type identifiers. Pre- or post-dependencies are determined by the preconditions and consequences of attack behavior sequences. If the consequences of attack behavior sequence A include the preconditions of attack behavior sequence B, then attack behavior sequence A is considered a pre-dependency of attack behavior sequence B, and attack behavior sequence B is considered a post-dependency of attack behavior sequence A.

[0101] For example, if the consequences of attack sequence A include obtaining ordinary user privileges in the system, and the prerequisite for attack sequence B includes having ordinary user privileges in the system, then attack sequence A is a prerequisite for attack sequence B, and attack sequence B is a post-requirement of attack sequence A.

[0102] If there are pre- or post-dependencies between the damage type identifiers, the attack pattern mapping module combines the damage type identifiers with pre-dependencies to generate a composite damage type identifier. The naming convention for the composite damage type identifier is pre-damage type identifier_post-damage type identifier. For example, if the pre-damage type identifier is information gathering and the post-damage type identifier is privilege escalation, then the composite damage type identifier would be information gathering_privilege escalation.

[0103] The attack pattern mapping module adjusts the vulnerability state transition probability of target topology nodes based on the composite damage type identifier. The vulnerability state transition probability refers to the probability that a system, when attacked, will transition from its current vulnerable state to a more severe vulnerable state. Different composite damage type identifiers correspond to different vulnerability state transition probabilities; the more damage types included in the composite damage type identifier, the more severe the damage, and the higher the corresponding vulnerability state transition probability.

[0104] Table 2 below lists some of the composite failure types and their corresponding vulnerability state transition probabilities in this embodiment: Table 2 Correspondence between composite failure type identifiers and vulnerability state transition probabilities The attack pattern mapping module writes the composite damage type identifier and the corresponding vulnerability state transition probability into the node attributes of the system-dependent topology graph. In subsequent cascading failure analysis, the security management platform will calculate the cascading failure threshold of the topology nodes based on the vulnerability state transition probability, thereby more accurately assessing the impact of multiple attack combinations on the system.

[0105] This embodiment dynamically reconstructs the system dependency topology graph by using exponential smoothing based on call frequency and judging the lower limit threshold of business interaction, eliminating low-frequency noise connections and improving the accuracy of the system dependency topology graph. By combining multiple attack behavior sequences mapped to the same node with pre- and post-dependencies to generate composite damage type identifiers, the vulnerability state transition probability is adjusted, and the impact of multiple attack behavior combinations on the system is assessed more accurately.

[0106] In one embodiment, when calculating the cascading failure threshold of topology nodes, the security management platform considers the dynamic change of the destructive force coefficient with the duration of the attack. The cascading failure threshold calculation module first reads the resource consumption records of the attack pattern in historical attack events from the historical attack event database. The historical attack event database stores detailed information on all past attack events, including attack start time, attack end time, attack pattern, and performance data such as CPU utilization, memory utilization, and bandwidth utilization during the attack.

[0107] The cascading failure threshold calculation module calculates the rate of change of the destructive force coefficient with the duration of the attack based on historical resource consumption records. Specifically, the module divides the attack duration into multiple time intervals, each lasting one minute. For each time interval, the module calculates the average overall load of the system within that interval and compares it with the overall load before the attack began, calculating the load increase. Based on the load increase, the module calculates the destructive force coefficient for each time interval and then uses linear regression analysis to calculate the rate of change of the destructive force coefficient with the duration of the attack. .

[0108] The cascading failure threshold calculation module constructs a time-varying decay function for the destructive force coefficient based on the rate of change. The time-varying decay function uses an exponential decay function, as shown in the following formula: in, This indicates that the attack duration is The destructive force coefficient at that time This represents the initial destructive force coefficient at the start of the attack. This represents the attenuation rate of the destructive force coefficient. This indicates the duration of the attack, in minutes.

[0109] The cascade failure threshold calculation module multiplies the capacity margin by the value of the time-varying decay function at the current moment to obtain the dynamically reduced capacity margin. The formula for calculating the dynamically reduced capacity margin is as follows: in, This indicates that the attack duration is Time node Dynamic reduction of capacity margin, Represents a node The initial capacity margin.

[0110] The cascading failure threshold calculation module calculates the dynamic cascading failure threshold of the topology nodes at the current moment. The formula for calculating the dynamic cascading failure threshold is as follows: in, This indicates that the attack duration is Time node The dynamic cascading failure threshold.

[0111] By introducing a time-varying decay function to calculate the dynamic cascading failure threshold, it is possible to adapt to the dynamic changes in resource consumption caused by attack behavior over time. Typically, the destructive power of an attack gradually diminishes over time as the system adapts to the attack or takes corresponding protective measures. The dynamic cascading failure threshold can reflect this change, improving the accuracy of cascading failure analysis.

[0112] In one embodiment, the security management platform handles situations where surviving neighboring nodes cannot carry the pre-allocated load when performing failover load distribution. Before distributing the failover load to surviving neighboring nodes, the cascading failure simulation module first calculates the sum of the current load and the pre-allocated load for each surviving neighboring node.

[0113] The cascading failure simulation module determines whether the accumulated value exceeds the capacity limit of surviving adjacent nodes. (Capacity limit) Set to 1, as described in the above embodiments.

[0114] If the accumulated value exceeds the capacity limit of the surviving neighbor node, the cascading failure simulation module refuses to allocate pre-allocated load to that surviving neighbor node and marks the pre-allocated load as overflow load. The cascading failure simulation module obtains the secondary neighbor node connected to the surviving neighbor node. The secondary neighbor node is a node that is directly connected to the surviving neighbor node through a directed edge and is not in a failed state.

[0115] The cascading failure simulation module distributes the overflow load to secondary adjacent nodes according to the same load distribution strategy as in the above embodiments. That is, the overflow load is distributed to secondary adjacent nodes according to the proportion of the weight of the directed edge to the total weight of all connected directed edges.

[0116] The cascading failure simulation module updates the current load of the secondary neighboring node and re-evaluates whether it exceeds its dynamic cascading failure threshold. If the current load of the secondary neighboring node exceeds its dynamic cascading failure threshold, the secondary neighboring node is marked as failed, its current load is determined as the new failed load, and load distribution continues.

[0117] If even the next-neighboring node cannot handle the overflow load (i.e., the sum of the current load of the next-neighboring node and the pre-allocated overflow load exceeds its capacity limit), the cascading failure simulation module will broadcast the overflow load across the system dependency topology graph. Broadcast dropping means distributing the overflow load evenly across all surviving nodes in the system dependency topology graph, with each surviving node bearing a load of: in, This represents the broadcast-style data drop load borne by each surviving node. This represents the total amount of overflow load. This indicates the number of currently alive nodes in the system dependency topology graph.

[0118] Because broadcast dropping distributes the overflow load evenly to all surviving nodes, each node only bears a small portion of the load, thus preventing any node from exceeding its capacity limit and blocking the unbounded spread of cascading failures.

[0119] Table 3 below lists the load handling methods at different load distribution stages in this embodiment: Table 3 Correspondence between Load Distribution Stages and Load Processing Methods This embodiment calculates the dynamic cascading failure threshold by introducing a time-varying decay function of the destructive force coefficient, adapting to the dynamic changes in resource consumption caused by attack behavior over time. During load allocation, when the sum of the current load of surviving adjacent nodes and the pre-allocated load exceeds the capacity limit, the overflow load is transferred to the secondary adjacent nodes or broadcast and discarded, thus blocking the unbounded spread of cascading failures, constraining the boundary conditions for calculating the scale of cascading failures, and reducing the interference of load overflow on the hierarchical results.

[0120] In one embodiment, the security management platform interfaces with the security classification assessment results and the smart city's emergency response system. When an information system's security level is classified as Level 1, the emergency response system will automatically trigger the highest-level emergency response plan, including notifying the department responsible for the information system, activating backup systems, severing unnecessary connections between the information system and other systems, and conducting comprehensive security testing and hardening of the information system. When an information system's security level is classified as Level 2, the emergency response system will trigger the intermediate-level emergency response plan, including notifying the department responsible for the information system, strengthening monitoring of the information system, and patching high-risk vulnerabilities in the information system. When an information system's security level is classified as Level 3 or Level 4, the emergency response system will trigger the low-level emergency response plan, including regularly conducting security checks on the information system and promptly patching discovered vulnerabilities.

[0121] In one embodiment, the security management platform periodically re-executes the security classification assessment method to update the security level of each information system. The re-execution interval can be set according to the security protection needs of the smart city, such as once a day, once a week, or once a month. By regularly updating the security level, changes in the security status of the smart city's information systems can be reflected in a timely manner, providing a basis for the dynamic adjustment of security protection strategies.

Claims

1. A method for security classification and evaluation of smart city information systems, characterized in that, include: Collect asset attribute data, network traffic data, and external threat intelligence from smart city information systems; Based on the asset attribute data and the network traffic data, a system dependency topology graph is constructed with information systems as nodes and call relationships as directed edges; Map the attack patterns in the external threat intelligence to the topology nodes of the system-dependent topology graph; Based on the load capacity coupling model, the cascading failure threshold of the topology node is calculated according to the resource occupancy status of the topology node and the attack mode. When the topology node is attacked and the cascading failure threshold is reached, the failed load of the topology node is transferred to the adjacent topology node according to the preset load distribution strategy, and the cascading failure scale of the system-dependent topology graph is calculated iteratively. By combining the single-point vulnerability score of the topology node with the cascading failure scale, the risk propagation index of the information system corresponding to the topology node is calculated; The information system is classified into security levels based on the ranking threshold of the risk propagation index.

2. The security classification and evaluation method for smart city information systems according to claim 1, characterized in that, The process of collecting asset attribute data, network traffic data, and external threat intelligence from smart city information systems, and constructing a system dependency topology graph with information systems as nodes and call relationships as directed edges based on the asset attribute data and network traffic data, includes: Extract the service instance identifier from the asset attribute data and the source Internet Protocol address and destination Internet Protocol address from the network traffic data; Session association is performed between the source Internet Protocol address and the destination Internet Protocol address to extract service message features during the session. The service instance identifier is mapped to a node in the system dependency topology graph, and the directed edge direction and edge weight between nodes are determined based on the call sequence and call frequency in the business message characteristics. Based on the nodes, the directed edge pointers, and the edge weights, a weighted directed system dependency topology graph is generated.

3. The method for security classification and evaluation of smart city information systems according to claim 1, characterized in that, Mapping attack patterns from the external threat intelligence to topology nodes in the system-dependent topology graph includes: Analyze the external threat intelligence to extract the attack behavior sequence and its corresponding preconditions and consequences; The prerequisites are matched with the current running state of the topology nodes in the system dependency topology graph using Boolean matching to filter out target topology nodes that meet the prerequisites. The attack sequence is associated with the target topology node, and the damage type identifier of the attack sequence on the target topology node is determined based on the impact consequences; The initial vulnerability state of the target topology node is updated based on the damage type identifier, thus completing the mapping of the attack mode to the topology node.

4. The method for security classification and evaluation of smart city information systems according to claim 1, characterized in that, The calculation of the cascading failure threshold of the topology node based on the load capacity coupling model, according to the resource occupancy status of the topology node and the attack mode, includes: Collect the CPU utilization, memory utilization, and bandwidth utilization of the topology nodes within a preset time window, and calculate the overall load value; The initial capacity limit is determined based on the hardware configuration parameters of the topology nodes; The load capacity coupling model is used to calculate the difference between the initial capacity limit and the comprehensive load value to obtain the capacity margin. The capacity margin is reduced based on the destructive power coefficient corresponding to the attack mode, and the ratio of the reduced capacity margin to the comprehensive load value is determined as the cascading failure threshold of the topology node.

5. The method for security classification and evaluation of smart city information systems according to claim 1, characterized in that, The step of transferring the failed load of the topology node to adjacent topology nodes according to a preset load distribution strategy, and iteratively calculating the cascading failure scale of the system-dependent topology graph, includes: When the current load of the topology node exceeds the cascading failure threshold, the topology node is marked as in a failed state, and its current load is determined as the failed load. Find the surviving neighboring nodes that are directly connected to the failed node through directed edges; The failed load is distributed to the surviving neighboring nodes according to the proportion of the weight of the directed edge to the total weight of all connected directed edges. Update the current load of the surviving adjacent nodes and re-determine whether the corresponding cascading failure threshold has been exceeded until no new failure nodes are generated. Count the final number of failure nodes as the cascading failure scale.

6. The security classification and evaluation method for smart city information systems according to claim 1, characterized in that, Combining the single-point vulnerability score of the topology node with the cascading failure scale, the risk propagation index of the information system corresponding to the topology node is calculated. Based on the ranking threshold of the risk propagation index, the information system is then classified into security levels, including: Obtain the vulnerability scan results corresponding to the topology node, and calculate the single-point vulnerability score based on the general vulnerability scoring system; Calculate the ratio of the cascading failure scale to the total number of nodes in the system dependency topology graph to obtain the risk diffusion ratio; The risk propagation index is generated by weighting and fusing the single-point vulnerability score with the risk diffusion ratio. The information systems are sorted in descending order of the risk propagation index, and then classified into different security levels based on the quantile cutoff value of the sorting position.

7. The security classification and evaluation method for smart city information systems according to claim 2, characterized in that, Following the generation of the weighted directed system dependency topology graph, the following is also included: Collect the latest network traffic data at fixed time intervals, and extract the current call sequence and current call frequency from the latest network traffic data; The current call frequency and the historical call frequency are exponentially smoothed to obtain a smoothed call frequency; Determine whether the smooth call frequency is lower than the preset business interaction lower limit threshold. If so, delete the corresponding directed edge in the system dependency topology graph. If not, the edge weight of the directed edge is updated to the normalized value of the smooth call frequency, and the directed edge pointer is updated based on the current call sequence to complete the dynamic reconstruction of the system dependency topology graph.

8. The security classification and evaluation method for smart city information systems according to claim 3, characterized in that, Updating the initial vulnerability state of the target topology node based on the damage type identifier, and completing the mapping from the attack mode to the topology node, further includes: When the same target topology node is mapped by multiple attack behavior sequences within the same time window, extract the damage type identifiers corresponding to the multiple attack behavior sequences. If there is a pre- or post-dependency relationship between the damage type identifiers, the damage type identifiers with pre-dependency relationships will be combined to generate a composite damage type identifier. The vulnerability state transition probability of the target topology node is adjusted according to the composite damage type identifier, and the composite damage type identifier and the vulnerability state transition probability are written into the node attributes of the system-dependent topology graph.

9. The security classification and evaluation method for smart city information systems according to claim 4, characterized in that, The capacity margin is reduced based on the destructive power coefficient corresponding to the attack mode, and the ratio of the reduced capacity margin to the overall load value is used to determine the cascading failure threshold of the topology node. This also includes: Based on the resource consumption records of the attack mode in historical attack events, calculate the rate of change of the destructive power coefficient with the duration of the attack; The time-varying decay function of the destructive force coefficient is constructed based on the rate of change; The capacity margin is multiplied by the function value of the time-varying decay function at the current time to obtain the dynamically reduced capacity margin; Calculate the ratio of the dynamic capacity reduction margin to the overall load value, and use the ratio as the dynamic cascading failure threshold of the topology node at the current moment.

10. The security classification and evaluation method for smart city information systems according to claim 5, characterized in that, Distributing the failed load to the surviving neighbor nodes according to the proportion of the weight of the directed edge to the total weight of all connected directed edges further includes: Before allocating the failed load to the surviving neighboring nodes, calculate the sum of the current load and the pre-allocated load of the surviving neighboring nodes; Determine whether the accumulated value exceeds the capacity limit of the surviving neighboring nodes; If the load exceeds the limit, the pre-allocated load will be refused to be allocated to the surviving neighboring nodes, and the pre-allocated load will be marked as an overflow load. The overflow load is transferred to a secondary neighbor node connected to the surviving neighbor node. If the secondary neighbor node cannot handle the load, the overflow load is broadcast and dropped in the system dependency topology graph.

Images