Trusted attack risk assessment method for trusted DCS system and related apparatus
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2025-05-29
- Publication Date
- 2026-08-13
Smart Images
Figure CN2025098168_13082026_PF_FP_ABST
Abstract
Description
Trusted Attack Risk Assessment Method and Related Devices for Trusted DCS Systems
[0001] This application claims priority to Chinese Patent Application No. 202510145503.6, filed on February 10, 2025, entitled “Method and Apparatus for Assessing Trusted Attack Risks of Trusted DCS Systems”, the entire contents of which are incorporated herein by reference. Technical Field
[0002] This application belongs to the field of risk assessment technology for trusted distributed control systems, and specifically relates to a trusted attack risk assessment method and related apparatus for trusted DCS systems. Background Technology
[0003] A distributed control system (DCS) is a new type of control equipment that uses computer technology to centrally monitor, operate, manage, and distribute industrial production processes. A trusted DCS system is based on a traditional DCS system and improves system security by introducing a trusted computing architecture.
[0004] During the operation of a trusted DCS system, user operation logs and audit information are continuously recorded to enable error tracing and risk level analysis. However, due to the large volume of data, poor readability, and unclear danger information in operation logs and audit information, maintenance personnel often need to manually and comprehensively examine all attributes of operation logs and audit information to determine the risk level in system risk level analysis. This results in a serious lag in risk level analysis, posing a significant hidden danger to the safe operation of the system. Summary of the Invention
[0005] To address the technical problems existing in the prior art, this application provides a trusted attack risk assessment method and related apparatus for trusted DCS systems. This solves the technical problem that in existing system risk level analysis, maintenance personnel often need to manually and comprehensively monitor all attributes of operation logs and audit information to determine the risk level, resulting in a serious lag in risk level analysis and posing a great hidden danger to the secure operation of the system.
[0006] To achieve the above objectives, the technical solution adopted in this application is as follows:
[0007] This application provides a trusted attack risk assessment method for trusted DCS systems, including:
[0008] Obtain real-time user operation record data of the system to be evaluated; wherein, the real-time user operation record data of the system to be evaluated includes log information and audit information of preset real-time operation behaviors in the system to be evaluated;
[0009] The real-time user operation record data of the system to be evaluated is preprocessed to generate a preprocessed real-time dataset.
[0010] The preprocessed real-time dataset is input into a pre-trained trusted attack risk assessment model, and the trusted attack risk assessment result of the system to be evaluated is output. The pre-trained trusted attack risk assessment model includes an input layer, a GRU gated neural network, a convolutional neural network, and a fully connected output layer.
[0011] Optionally, the preset real-time operation behaviors include login, operation commands, access to resources, and policy configuration;
[0012] The log information of the preset real-time operation behavior includes the operation type, operation username, operation timestamp, operation object, operation result, and operation execution process of the preset real-time operation behavior; the audit information of the preset real-time operation behavior includes the audit log and audit report of the preset real-time operation behavior.
[0013] Optionally, the process of preprocessing the real-time user operation record data of the system to be evaluated to generate a preprocessed real-time dataset is as follows:
[0014] The real-time user operation record data of the system to be evaluated is cleaned, standardized and feature extracted to obtain preprocessed real-time user operation record data; wherein, one-hot encoding technology is used to extract features during feature extraction.
[0015] The preprocessed real-time user operation records are converted into a data format suitable for machine learning models to obtain a preprocessed real-time dataset.
[0016] Optionally, the input layer is used to read input features from the preprocessed real-time dataset; wherein the input features are three-dimensional matrices, and the three-dimensional matrix includes time step dimension, sequence dimension and time point dimension;
[0017] Specifically, the input features for each time step dimension include a sequence of preset length; the input features for each sequence dimension include several user operation record data prior to the current time point; each user operation record data is a time point; the input features for each time point dimension are input feature vectors of preset length, which include the operation type, operation username, operation timestamp, operation object, operation result, and operation execution process of the operation behavior.
[0018] Optionally, the GRU gated neural network includes 128 GRU units; wherein each GRU unit includes a reset gate and an update gate; the convolutional layer of the convolutional neural network is configured with 64 filters, the convolutional kernel size is 3, and the max pooling method is selected.
[0019] Optionally, the fully connected output layer is used to output risk level values and obtain the trusted attack risk assessment results of the system to be evaluated based on a preset risk level range; wherein the risk level values are floating-point data.
[0020] This application also provides a trusted attack risk assessment system for a trusted DCS system, including:
[0021] The real-time data acquisition module is used to acquire real-time user operation record data of the system to be evaluated; wherein, the real-time user operation record data of the system to be evaluated includes the user's real-time operation log and audit information;
[0022] The real-time data processing module is used to preprocess the real-time user operation record data of the system to be evaluated and generate a preprocessed real-time dataset.
[0023] The risk assessment module is used to input the preprocessed real-time dataset into a pre-trained trusted attack risk assessment model and output the trusted attack risk assessment result of the system to be assessed; wherein, the pre-trained trusted attack risk assessment model includes an input layer, a GRU gated neural network, a convolutional neural network and a fully connected output layer.
[0024] This application also provides a trusted attack risk assessment device for a trusted DCS system, including:
[0025] A processor is used to execute computer programs;
[0026] A computer-readable storage medium storing a computer program, which, when executed by the processor, performs the aforementioned trusted attack risk assessment method for a trusted DCS system.
[0027] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned trusted attack risk assessment method for a trusted DCS system.
[0028] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the aforementioned trusted attack risk assessment method for a trusted DCS system.
[0029] Compared with the prior art, the beneficial effects of this application are as follows:
[0030] The trusted attack risk assessment method for trusted DCS systems provided in this application effectively improves the efficiency of log review and auditing by operations and maintenance personnel by acquiring and preprocessing real-time user operation logs and using a pre-trained trusted attack risk assessment model. This, in turn, enhances the real-time performance and accuracy of trusted attack risk assessment in trusted DCS systems, strengthens system credibility and security, and improves system operation and maintenance efficiency and response speed. Specifically, by acquiring real-time user operation logs and audit information, the method ensures that the data source for risk assessment is the latest and most accurate, facilitating the timely detection and response to potential attack risks. Preprocessing the real-time operation logs generates a more standardized and unified dataset, thereby improving the processing efficiency and accuracy of the subsequent risk assessment model. Using a pre-trained trusted attack risk assessment model for risk assessment can fully leverage the model's learning and generalization capabilities to quickly and accurately assess potential attack risks. Specifically, the pre-trained trusted attack risk assessment model employs a combination of GRU gated neural networks and convolutional neural networks, effectively capturing temporal and spatial features in user operation log data, thus improving the accuracy and robustness of risk assessment. Specifically, the GRU network processes sequence data to capture temporally correlated anomalies, enabling the model to identify dependencies between user operations. The convolutional neural network captures anomalies that may arise from a group of operations within a short period, capturing spatial features in the user operation log data. This allows the model to better understand user behavior and accurately assess potential attack risks. Attached Figure Description
[0031] Figure 1 is a flowchart of the trusted attack risk assessment method for a trusted DCS system provided in Example 1;
[0032] Figure 2 is a structural block diagram of the trusted attack risk assessment system for a trusted DCS system provided in Example 2;
[0033] Figure 3 is a structural block diagram of the trusted attack risk assessment device for a trusted DCS system provided in Example 3. Detailed Implementation
[0034] To make the technical problems solved by this application, the technical solutions, and the beneficial effects clearer, the following specific embodiments provide a further detailed description of this application. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit this application.
[0035] Example 1
[0036] As shown in Figure 1, this embodiment 1 provides a trusted attack risk assessment method for a trusted DCS system, including the following steps:
[0037] Step 1: Obtain the user historical operation record data of the system to be evaluated; wherein, the user historical operation record data of the system to be evaluated includes log information and audit information of preset historical operation behaviors in the system to be evaluated.
[0038] Specifically, the process of obtaining historical user operation records for the system to be evaluated is as follows:
[0039] Accessing the backend of the system under evaluation via TCP / IP protocol, and obtaining log and audit information of preset historical operation behaviors from the system under evaluation through a pre-determined data interface; wherein, the preset historical operation behaviors include login, operation commands, access to resources, and policy configuration; specifically, the operation type, operation username, operation timestamp, operation object, operation result, and operation execution process of the preset historical operation behaviors; the audit information of the preset historical operation behaviors includes audit logs and audit reports of the preset operation behaviors; it should be noted that during the operation of the trusted DCS system, user login, operation commands, access to resources, and policy configuration behaviors will all generate operation logs and audit information to record the response information generated by the trusted DCS system when performing the above operations.
[0040] Step 2: Preprocess the user historical operation record data of the system to be evaluated to generate a preprocessed historical dataset.
[0041] Specifically, the implementation process for preprocessing the user historical operation record data of the system to be evaluated is as follows:
[0042] Step 21: Perform data cleaning, standardization, and feature extraction on the user historical operation record data of the system to be evaluated to obtain preprocessed user historical operation record data; wherein, the data cleaning process includes the steps of removing invalid or duplicate record data and filling missing values; the standardization process includes the steps of standardizing data format or converting data type to ensure the instructions and consistency of the input historical data; since the operation type, operation username, operation object, and operation execution process of the operation behavior are all string data, one-hot encoding technology is used to extract features during feature extraction.
[0043] Step 22: Convert the preprocessed user history operation record data into a data format suitable for machine learning model processing to obtain the preprocessed historical dataset.
[0044] Step 3: Construct a trusted attack risk assessment model; use the preprocessed historical dataset to train the constructed trusted attack risk assessment model to obtain a pre-trained trusted attack risk assessment model.
[0045] In this embodiment 1, the trusted attack risk assessment model includes an input layer, a GRU gated neural network, a convolutional neural network, and a fully connected output layer.
[0046] The input layer is used to read input features from preprocessed historical datasets or preprocessed real-time datasets. The input features are three-dimensional matrices, including time step dimensions, sequence dimensions, and time point dimensions. Specifically, the input features for each time step dimension include a sequence of a preset length; optionally, the preset length sequence is a sequence of length 1000. The input features for each sequence dimension include several user operation records prior to the current time point; optionally, the input features for each sequence dimension include 1000 user operation records prior to the current time point; each user operation record is considered a time point. The input features for each time point dimension are input feature vectors of a preset length, including the operation type, username, timestamp, object, result, and execution progress of the operation.
[0047] The GRU-gated neural network is used to capture information in long sequences; specifically, it is used to capture anomalous events with temporal correlation; for example, anomalies that may be caused by a series of discontinuous operations in a time series; optionally, the GRU-gated neural network includes 128 GRU units; wherein, the GRU-gated neural network is used to receive the data output from the input layer, with the input shape being a matrix of type (sequence length, feature dimension), and the output being a feature vector of length 128; where sequence length is the sequence length and feature dimension is the feature dimension.
[0048] The convolutional neural network (CNN) is used to capture anomalies that may be caused by a set of operations within a short period of time. The CNN receives data output from the input layer as an input matrix of shape (sequence length, feature dimension). The CNN's convolutional layers have 64 filters, a kernel size of 3, a ReLU activation function, and use max pooling. The CNN outputs a feature vector of length N, where N depends on the configuration of the CNN's network parameters.
[0049] The fully connected output layer is used to output risk level values and obtain the trusted attack risk assessment results of the system to be evaluated based on the preset risk level range. Specifically, the fully connected output layer takes the feature vectors output by the GRU gated neural network and the convolutional neural network as input, obtains a vector of length 128+N through a vector concatenation algorithm, and finally calculates the risk level value based on the vector of length 128+N. The risk level value is floating-point data, and the preset risk level range includes secure level, low risk level, medium risk level, high risk level, and dangerous level. Among them, the risk level value range of the secure level is (0, 0.2), the risk level value range of the low risk level is (0.2, 0.4), the risk level value range of the medium risk level is (0.4, 0.6), the risk level value range of the high risk level is (0.6, 0.8), and the risk level value range of the dangerous level is (0.8, 1.0).
[0050] In this embodiment 1, the process of training the constructed trusted attack risk assessment model using the preprocessed historical dataset to obtain the pre-trained trusted attack risk assessment model is as follows:
[0051] The preprocessed historical dataset is divided into a training set and a test set. The constructed trusted attack risk assessment model is trained using the training set to adjust the preset model parameters until the loss continuously decreases to below 1e-4. The preset model parameters include the learning rate and batch size. Then, the performance of the trained model on unseen data is evaluated using the test set to ensure that the training yields a model with optimal parameters, and the pre-trained trusted attack risk assessment model is output. During the model training process, the loss and accuracy of the test set are calculated at the end of each training session to monitor the learning effect of the model.
[0052] It should be noted that during the model's operation, by reading user annotations on operation logs and audit information through the preset data interface with the trusted server in the trusted DCS system, alarm information in logs and audits can be annotated on the trusted management platform. The annotated logs and audit alarm information can then be used to fine-tune the trusted attack risk assessment model to ensure that the model is optimal.
[0053] Alternatively, when logs and audit information are updated in large quantities, a relearning function can be performed to ensure the model is optimal; specifically, all existing logs and audit information in the trusted server can be obtained and input into the trusted attack risk assessment model for retraining.
[0054] Step 4: Obtain real-time user operation record data of the system to be evaluated; wherein, the real-time user operation record data of the system to be evaluated includes log information and audit information of preset real-time operation behaviors in the system to be evaluated. Specifically, the preset real-time operation behaviors include login, operation commands, access to resources and policy configuration; the log information of the preset real-time operation behaviors includes the operation type, operation username, operation timestamp, operation object, operation result and operation execution process of the preset real-time operation behaviors; the audit information of the preset real-time operation behaviors includes audit logs and audit reports of the preset real-time operation behaviors.
[0055] It should be noted that the process of obtaining real-time user operation record data of the system to be evaluated is the same as the process of obtaining historical user operation record data of the system to be evaluated in step 1 above, and will not be repeated here.
[0056] Step 5: Preprocess the real-time user operation record data of the system to be evaluated to generate a preprocessed real-time dataset. The specific process of preprocessing the real-time user operation record data of the system to be evaluated to generate the preprocessed real-time dataset is as follows:
[0057] The real-time user operation record data of the system to be evaluated is cleaned, standardized and feature extracted to obtain preprocessed real-time user operation record data; wherein, one-hot encoding technology is used to extract features during feature extraction.
[0058] The preprocessed real-time user operation records are converted into a data format suitable for machine learning models to obtain a preprocessed real-time dataset.
[0059] Step 6: Input the preprocessed real-time dataset into the pre-trained trusted attack risk assessment model, and output the trusted attack risk assessment result of the system to be evaluated.
[0060] Step 7: Display the trusted attack risk assessment results of the system to be evaluated. If the trusted attack risk assessment result of the system to be evaluated is at least medium risk, a preset alarm signal will be output while displaying the trusted attack risk assessment result; optionally, the preset alarm signal includes flashing alarm lights and voice prompts.
[0061] The trusted attack risk assessment method for trusted DCS systems described in Embodiment 1 extracts risk features from user and system operation logs and audits for automatic and intelligent risk warning. Specifically, it utilizes a GRU network to process sequence data to capture time-correlated anomalies, enabling the capture of dependencies between user operations. Furthermore, it employs a convolutional neural network to capture anomalies that may arise from a group of operations within a short period, thereby capturing spatial features in user operation record data. This effectively improves the efficiency of log review and auditing by operations and maintenance personnel, providing a more sensitive and accurate risk identification capability.
[0062] Example 2
[0063] As shown in Figure 2, this embodiment 2 provides a trusted attack risk assessment system for a trusted DCS system, including a historical data acquisition module, a historical data processing module, a model training module, a real-time data acquisition module, a real-time data processing module, a risk assessment module, and an assessment result display module.
[0064] The system comprises the following modules: a historical data acquisition module, used to acquire historical user operation records of the system to be evaluated; wherein, the historical user operation records of the system to be evaluated include log information and audit information of preset historical operation behaviors in the system to be evaluated. A historical data processing module is used to preprocess the historical user operation records of the system to be evaluated to generate a preprocessed historical dataset. A model training module is used to construct a trusted attack risk assessment model; using the preprocessed historical dataset, the constructed trusted attack risk assessment model is trained to obtain a pre-trained trusted attack risk assessment model. A real-time data acquisition module is used to acquire real-time user operation records of the system to be evaluated; wherein, the real-time user operation records of the system to be evaluated include log information and audit information of preset real-time operation behaviors in the system to be evaluated. A real-time data processing module is used to preprocess the real-time user operation records of the system to be evaluated to generate a preprocessed real-time dataset. A risk assessment module is used to input the preprocessed real-time dataset into the pre-trained trusted attack risk assessment model and output the trusted attack risk assessment result of the system to be evaluated. An assessment result display module is used to display the trusted attack risk assessment result of the system to be evaluated.
[0065] Example 3
[0066] As shown in Figure 3, this embodiment 3 provides a trusted attack risk assessment device for a trusted DCS system, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of a trusted attack risk assessment method for a trusted DCS system.
[0067] When the processor executes the computer program, it implements the steps of the aforementioned trusted attack risk assessment method for a trusted DCS system; for example:
[0068] The process involves: acquiring historical user operation records of the system to be evaluated; including log information and audit information of preset historical operation behaviors in the system; preprocessing the historical user operation records to generate a preprocessed historical dataset; constructing a trusted attack risk assessment model; training the constructed trusted attack risk assessment model using the preprocessed historical dataset to obtain a pre-trained trusted attack risk assessment model; acquiring real-time user operation records of the system to be evaluated; including log information and audit information of preset real-time operation behaviors in the system; preprocessing the real-time user operation records to generate a preprocessed real-time dataset; inputting the preprocessed real-time dataset into the pre-trained trusted attack risk assessment model to output the trusted attack risk assessment result of the system to be evaluated; and displaying the trusted attack risk assessment result of the system to be evaluated.
[0069] Alternatively, when the processor executes the computer program, it implements the functions of each module in the trusted attack risk assessment system for the trusted DCS system described above, for example:
[0070] The system comprises the following modules: a historical data acquisition module, used to acquire historical user operation records of the system to be evaluated; wherein, the historical user operation records of the system to be evaluated include log information and audit information of preset historical operation behaviors in the system to be evaluated. A historical data processing module is used to preprocess the historical user operation records of the system to be evaluated to generate a preprocessed historical dataset. A model training module is used to construct a trusted attack risk assessment model; using the preprocessed historical dataset, the constructed trusted attack risk assessment model is trained to obtain a pre-trained trusted attack risk assessment model. A real-time data acquisition module is used to acquire real-time user operation records of the system to be evaluated; wherein, the real-time user operation records of the system to be evaluated include log information and audit information of preset real-time operation behaviors in the system to be evaluated. A real-time data processing module is used to preprocess the real-time user operation records of the system to be evaluated to generate a preprocessed real-time dataset. A risk assessment module is used to input the preprocessed real-time dataset into the pre-trained trusted attack risk assessment model and output the trusted attack risk assessment result of the system to be evaluated. An assessment result display module is used to display the trusted attack risk assessment result of the system to be evaluated.
[0071] For example, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing preset functions, wherein the instruction segments describe the execution process of the computer program in the trusted attack risk assessment device for the trusted DCS system.
[0072] The trusted attack risk assessment device for a trusted DCS system can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. This device may include, but is not limited to, processors and memory. Those skilled in the art will understand that the above are examples of trusted attack risk assessment devices for trusted DCS systems and do not constitute a limitation on such devices. The device may include more components than described above, or combine certain components, or use different components. For example, the trusted attack risk assessment device for a trusted DCS system may also include input / output devices, network access devices, buses, etc.
[0073] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or any conventional processor. This processor is the control center of the trusted attack risk assessment device for the trusted DCS system, connecting all parts of the trusted attack risk assessment device for the trusted DCS system via various interfaces and lines.
[0074] The memory can be used to store the computer program and / or modules. The processor implements various functions of the trusted attack risk assessment device for the trusted DCS system by running or executing the computer program and / or modules stored in the memory and calling the data stored in the memory.
[0075] The memory may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function (such as sound playback or image playback). The data storage area may store data created based on the use of the phone (such as audio data or a phonebook). Furthermore, the memory may include high-speed random access memory (RAM) and non-volatile memory, such as hard disks, RAM, plug-in hard disks, SmartMediaCards (SMC), Secure Digital (SD) cards, flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.
[0076] Example 4
[0077] This embodiment 4 also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the trusted attack risk assessment method for a trusted DCS system described above.
[0078] If the modules / units integrated in the trusted attack risk assessment system for the trusted DCS system are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
[0079] Based on this understanding, the implementation of all or part of the processes in the aforementioned trusted attack risk assessment method for a trusted DCS system can also be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the aforementioned trusted attack risk assessment method for a trusted DCS system. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or a preset intermediate form, etc.
[0080] The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.
[0081] It should be noted that the content contained in the computer-readable storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable storage medium does not include electrical carrier signals and telecommunication signals.
[0082] Example 5
[0083] This embodiment 5 provides a computer product, which includes a computer program stored in a computer-readable storage medium. The processor of the trusted attack risk assessment device for a trusted DCS system reads the computer program from the computer-readable storage medium and executes the computer program, so that the trusted attack risk assessment device for a trusted DCS system can execute the trusted attack risk assessment method for a trusted DCS system described in embodiment 1, which will not be repeated here.
[0084] It should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above methods.
[0085] The trusted attack risk assessment method for trusted DCS systems described in this application extracts trusted attack risk features from user and system operation logs and audit information through a trusted attack risk assessment model based on GRU gated neural networks and convolutional neural networks. This enables automatic and intelligent trusted attack risk warnings, effectively improving the efficiency of log review and audit processing by operation and maintenance personnel, and providing a more sensitive and accurate risk identification capability.
[0086] The above embodiments are merely one of the implementation methods for the technical solution of this application. The scope of protection claimed by this application is not limited to this embodiment, but also includes any variations, substitutions and other implementation methods that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application.
Claims
1. A method for assessing the risk of trusted attacks in a trusted DCS system, characterized in that, include: Obtain real-time user operation record data of the system to be evaluated; wherein, the real-time user operation record data of the system to be evaluated includes log information and audit information of preset real-time operation behaviors in the system to be evaluated; The real-time user operation record data of the system to be evaluated is preprocessed to generate a preprocessed real-time dataset. The preprocessed real-time dataset is input into a pre-trained trusted attack risk assessment model, and the trusted attack risk assessment result of the system to be evaluated is output. The pre-trained trusted attack risk assessment model includes an input layer, a GRU gated neural network, a convolutional neural network, and a fully connected output layer.
2. The method for assessing the trusted attack risk of a user-trusted DCS system according to claim 1, characterized in that, The preset real-time operation behaviors include login, operation commands, access to resources, and policy configuration; The log information of the preset real-time operation behavior includes the operation type, operation username, operation timestamp, operation object, operation result, and operation execution process of the preset real-time operation behavior; The audit information for the preset real-time operation behavior includes audit logs and audit reports for the preset real-time operation behavior.
3. The trusted attack risk assessment method for a trusted DCS system according to claim 1, characterized in that, The process of preprocessing the real-time user operation record data of the system to be evaluated to generate a preprocessed real-time dataset is as follows: The real-time user operation record data of the system to be evaluated is cleaned, standardized and feature extracted to obtain preprocessed real-time user operation record data; wherein, one-hot encoding technology is used to extract features during feature extraction. The preprocessed real-time user operation records are converted into a data format suitable for machine learning models to obtain a preprocessed real-time dataset.
4. The trusted attack risk assessment method for a trusted DCS system according to claim 2, characterized in that, The input layer is used to read input features from the preprocessed real-time dataset; wherein, the input features are three-dimensional matrices, and the three-dimensional matrix includes time step dimension, sequence dimension and time point dimension; Specifically, the input features for each time step dimension include a sequence of preset length; the input features for each sequence dimension include several user operation record data prior to the current time point; each user operation record data is a time point; the input features for each time point dimension are input feature vectors of preset length, which include the operation type, operation username, operation timestamp, operation object, operation result, and operation execution process of the operation behavior.
5. The trusted attack risk assessment method for a trusted DCS system according to claim 1, characterized in that, The GRU gated neural network includes 128 GRU units; each GRU unit includes a reset gate and an update gate; the convolutional layer of the convolutional neural network is configured with 64 filters, the kernel size is 3, and max pooling is selected.
6. The trusted attack risk assessment method for a trusted DCS system according to claim 1, characterized in that, The fully connected output layer is used to output risk level values and obtain the trusted attack risk assessment results of the system to be evaluated based on a preset risk level range; wherein the risk level values are floating-point data.
7. A trusted attack risk assessment system for a trusted DCS system, characterized in that, include: The real-time data acquisition module is used to acquire real-time user operation record data of the system to be evaluated; wherein, the real-time user operation record data of the system to be evaluated includes log information and audit information of preset real-time operation behaviors in the system to be evaluated; The real-time data processing module is used to preprocess the real-time user operation record data of the system to be evaluated and generate a preprocessed real-time dataset. The risk assessment module is used to input the preprocessed real-time dataset into a pre-trained trusted attack risk assessment model and output the trusted attack risk assessment result of the system to be assessed; wherein, the pre-trained trusted attack risk assessment model includes an input layer, a GRU gated neural network, a convolutional neural network and a fully connected output layer.
8. A trusted attack risk assessment device for a trusted DCS system, characterized in that, include: A processor is used to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, performs the trusted attack risk assessment method for a trusted DCS system as described in any one of claims 1-6.
9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the trusted attack risk assessment method for a trusted DCS system as described in any one of claims 1-6.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the trusted attack risk assessment method for a trusted DCS system as described in any one of claims 1-6.