CN110493200B - A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map - Google Patents
A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map Download PDFInfo
- Publication number
- CN110493200B CN110493200B CN201910686625.0A CN201910686625A CN110493200B CN 110493200 B CN110493200 B CN 110493200B CN 201910686625 A CN201910686625 A CN 201910686625A CN 110493200 B CN110493200 B CN 110493200B
- Authority
- CN
- China
- Prior art keywords
- control system
- threat
- industrial control
- risk
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
- G06F2221/034—Test or assess a computer or a system
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
本发明提供了一种基于威胁地图的工控系统风险量化分析方法，该方法包括：首先对所述工控系统中工业流程面临的攻击进行行为分析，建立一种基于认知地图形式的威胁地图；然后根据所述威胁地图，构建所述工控系统的信息资产风险值公式；根据所述工控系统的信息资产风险值公式计算出的风险值，对所述工控系统进行风险评估，并由此确定对所述工控系统采取何种措施以确保所述工控系统的安全。该方法从工业流程中的行为角度出发，探究了工控系统安全问题的本质成因及内在的相互作用关系，避免了主观判断上的失误和缺陷，从而更为精确的评估工控系统的风险程度。
The present invention provides a method for quantitative analysis of industrial control system risk based on threat map. The method includes: first, conduct behavioral analysis on attacks faced by industrial processes in the industrial control system, and establish a threat map based on a cognitive map; then According to the threat map, construct the information asset risk value formula of the industrial control system; according to the risk value calculated by the information asset risk value formula of the industrial control system, perform a risk assessment on the industrial control system, and thus determine the risk value of the industrial control system. What measures are taken by the industrial control system to ensure the safety of the industrial control system. From the perspective of behavior in the industrial process, this method explores the essential causes and internal interaction of industrial control system security problems, avoids errors and defects in subjective judgments, and more accurately evaluates the risk level of industrial control systems.
Description
Technical Field
The invention relates to safety problem analysis of industrial control system information assets, in particular to a threat map-based industrial control system risk quantitative analysis method.
Background
Due to rapid development of science and technology, modern information technology is actively applied to an industrial control system (referred to as an industrial control system for short), but due to many vulnerabilities of network equipment and communication protocols in industrial processes, such as lack of prevention of illegal access to components of the industrial control system, use of wireless communication, unclear boundary between an enterprise and an industrial network segment, untimely or incorrect software updating, etc., the vulnerabilities can cause information assets of the industrial control system to be easily damaged.
Aiming at the information security problem of an industrial control system, a plurality of solutions, standards and specifications have been proposed at home and abroad, common prevention strategies include a white list mechanism, physical isolation, industrial protocol deep analysis, vulnerability scanning, cloud platform management protection and the like, a certain effect is achieved on the protection of information assets, and still greater potential safety hazards exist. At present, solutions for industrial control security problems mainly focus on protection, traditional information security technologies are applied to industrial control systems, acting objects mainly include networks and host equipment, abnormal auditing is mainly performed based on incomplete data and flow, behavioral analysis in industrial processes is lacked, and essential causes and internal interaction relations of industrial control system security problems are not deeply explored.
Disclosure of Invention
Aiming at the problems, the invention provides a risk quantitative analysis method of an industrial control system based on a threat map, which specifically comprises the following steps:
s1), performing behavior analysis on the attack faced by the industrial process in the industrial control system, and determining 3 types of elements for establishing a threat map according to the actual environment of the industrial control system: the method comprises the steps that a threat source, an object to be protected and an intermediate node are arranged, wherein the object to be protected is an information asset which needs to be protected by the industrial control system, a line, reaching the position of the object to be protected through the intermediate node, of the threat source is a threat path generating a threat, and a threat map based on a cognitive map form is established according to the 3 types of elements;
s2) according to the threat map obtained in the step S1), constructing an information asset risk value formula of the industrial control system:
this formula is used to quantify the risk faced by the industrial control system, where viRepresents the value, Σ, of an information asset invnThe total value of the information assets in the industrial control system; dkjiThe vulnerability of an intermediate node k in a threat path for a threat source j to intrude into an information asset i, where k is the number of the intermediate node，dkjiThe value interval of (1) is (0); m is the total number of intermediate nodes in the threat path of the threat source j invading the information asset i; i, j, m and n are positive integers;
s3) carrying out risk assessment on the industrial control system according to the risk value calculated by the information asset risk value formula of the industrial control system in the step S2): comparing the calculated risk value with a preset risk threshold, and if the calculated risk value is lower than the preset risk threshold, indicating that the threat faced by the industrial control system is within an acceptable range; if the calculated risk value is higher than the preset risk threshold, it indicates that the industrial control system faces the attacked risk, and at this time, the vulnerability of the intermediate node in the threat path needs to be reduced by adding or replacing a protection measure of the intermediate node in the threat path, so as to reduce the risk value to be below the preset risk threshold.
According to the industrial control system risk quantitative analysis method based on the threat map, the threat map in the form of the cognitive map is established according to the behavior analysis of the industrial process in the industrial control system, the threat map describes the potential threat and source of the information assets in the industrial control system based on the form of the cognitive map, and the behavior analysis in the industrial process can be effectively supported. On the basis of the threat map, a formula for quantizing the information asset risk value of the industrial control system is further provided, the formula calculates the risk degree of the information asset in the industrial control system according to the value of the information asset and the vulnerability degree of the intermediate node of the threat path, the risk degree is used for evaluating the risk of the industrial control system, whether the threat faced by the industrial control system is within an acceptable range is judged by comparing the information asset risk value calculated by the formula with a preset risk threshold value, if the threat is not within the acceptable range, the protective measures of the node in the threat path are added or replaced according to the actual condition, and the risk of the industrial control system is reduced to the acceptable level. The industrial control system risk quantitative analysis method based on the threat map provided by the invention is based on the behavior in the industrial flow, the essential cause and the internal interaction relation of the safety problem of the industrial control system are explored, the possible risks and sources of the industrial control system in the industrial flow are intuitively reflected in the form of the threat map, the information asset value and the influence strength of the vulnerability of industrial control equipment on the safety of the industrial control system are objectively analyzed by means of quantitative analysis, and the errors and defects in subjective judgment are avoided, so that the risk degree of the industrial control system is more accurately evaluated.
Drawings
FIG. 1 is a schematic structural diagram of a threat map constructed in accordance with the present invention
FIG. 2 is a schematic structural diagram of a threat map according to an embodiment of the present invention
Detailed Description
The invention aims to analyze potential risks and the influence thereof in the information environment of the industrial control system by establishing a threat map, wherein risk analysis is an important link for guaranteeing information safety, and in order to make the purposes, technical schemes and advantages of the invention clearer and clearer, the technical schemes of the invention are further described in detail below with reference to the attached drawings and specific implementation modes.
The invention provides an industrial control system risk quantitative analysis method based on a threat map, which is characterized in that the threat map in a cognitive map form is established according to behavior analysis of an industrial process in an industrial control system, a structural schematic diagram of the threat map is shown in fig. 1, and the threat map can describe where a potential threat may come from in the process of processing the industrial control system, and which loopholes of the industrial control system are utilized and which valuable information assets in the industrial control system are damaged. The threat map is used for constructing a threat path which threatens information assets of an industrial control system, and 3 types of elements are required to be firstly determined to establish the threat map, wherein the elements are respectively a threat source, an object to be protected and an intermediate node (referred to as an intermediate node for short) of the threat path.
In the threat map, threat sources are divided into 4 levels of a1, b1, c1 and d1 according to the possibility of generating threats, and the threat levels are ranked as a1< b1< c1< d 1:
a1. external attacker: potential attackers in the external network environment are less threatening due to their unknown nature.
b1. The remote user: and the internal users who access remotely are not in direct contact with the internal network of the industrial control system, so the threat is moderate.
c1. Local area network internal users: and the threat of the users in the local area network of the industrial control system is high.
d1. The industrial control system authorizes the user: the industrial control system authorizes the user, can directly access and use the industrial control system equipment, and directly threatens the industrial control system due to possible abuses, misoperation and other behaviors, so that the threat is high.
The object to be protected of the threat map is an information asset needing to be protected, the information asset is divided into 4 types according to the type, data, instruction information, configuration information and software information are operated, and the position of the threat map is required to be determined when the threat map is constructed. In the industrial process, the position of the object to be protected and the related information assets include, but are not limited to, the following:
a2. a data server: operational data from the sensors.
b2. Programmable Logic Controller (PLC): and realizing software information of the PLC algorithm.
c2. OLE (OLE) for Process Control server for Process Control: OPC server instruction information.
d2. Data Acquisition And Supervisory Control (SCADA) server: SCADA operating data and SCADA system instruction information.
e2. Operator Personal Computer (PC): software information for implementing a Human Machine Interface (HMI).
f2. Person Computer (PC) for security management: personal PC configuration information.
The threat source carries out invasion on the object to be protected through the intermediate node, and the invasion modes mainly include the following three modes:
(1) and directly accessing through the equipment interface to carry out physical intrusion.
(2) And local system intrusion is carried out through local network access.
(3) And performing remote intrusion through remote network access.
The network facilities involved in the intrusion process are intermediate nodes of the threat path, and the intermediate nodes are divided into two types, namely network basic equipment and a server, and specifically comprise the following steps:
a3. network infrastructure equipment: routers, switches, firewalls, Virtual Private Networks (VPNs), Intrusion Detection Systems (IDSs), master data logging Systems, workstations, and the like.
b3. A server: a sparse zone (DMZ) server, a database server, etc.
On the basis of the threat map, the invention provides a quantifiable industrial control system risk analysis method, and the information asset risk value of the industrial control system can be obtained by calculation through a formula (1):
wherein v isiRepresents the value, Σ, of an information asset invnThe total value of the information assets in the industrial control system; dkjiThe vulnerability (i.e. the probability of success of intrusion of the threat source) of an intermediate node k in the threat path for the intrusion of the information asset i by the threat source j, wherein k is the number of the intermediate node, d is the number of the intermediate nodekjiThe value interval of (1) is (0); and m is the total number of intermediate nodes in the threat path of the threat source j invading the information asset i.
The risk value calculated by the formula (1) is used for carrying out risk assessment on the industrial control system, and is compared with a preset risk threshold value, if the risk value is lower than the preset risk threshold value, the threat faced by the industrial control system is in an acceptable range; if the risk value is higher than the preset risk threshold, the industrial control system is indicated to be attacked, and the vulnerability degree of the intermediate nodes in the threat path can be reduced by adding or replacing protective measures of the intermediate nodes in the threat path so as to reduce the risk value to be lower than the preset risk threshold.
Before risk analysis is performed on a specific implementation, 3 types of elements, a threat source, an object to be protected and an intermediate node of a threat map need to be determined according to the environment of an actual industrial control system, as shown in fig. 1, a route from the threat source to the position of the object to be protected through the intermediate node is a critical route for generating a threat, namely a threat route.
S1) setting a threat source j in the industrial control system. According to the threat source grade, e.g. setting 3 types of threat sources, remote users (threat medium) j1J (high threat) of local area network internal user2J, authorizing users (with high threat) by industrial control system3。
S2) determining the object to be protected, i.e. the information asset i which needs to be protected. Setting the operation data i in the data server as the information assets to be protected according to the type and the position of the information assets1Operation data i in SCADA server2Command information i in SCADA Server3Command information i in OPC Server4Configuration information i in the personal computer of the security administration5Software information i for realizing PLC algorithm in PLC6HMI software information i in the operator PC7The value of each information asset is set according to the importance level of the information asset. If set to i1Value v of1＝15，i2Value v of2＝20，i3Value v of3＝35，i4Value v of4＝40，i5Value v of5＝15，i6Value v of6＝10，i7Value v of7A larger value indicates a greater value of the information asset than 5.
S3) determining intermediate nodes of the threat path through industrial process behaviors of the industrial control system. The threat source threatens the industrial control system through 3 modes of physical invasion, local system invasion and remote invasion, and after the access to the local area network of the industrial control system is obtained, the threat source tries to intercept related identity authentication information and obtains a related secret key of a network host from a data stream. However, due to different access rights of users, the acquired identity information may have access limitation, in which case the threat source will try to collect the obsolete information from the database server and try to acquire the identity information with higher access rights. In addition, the threatThe source may also inject malicious code to acquire and remove data, enable unauthorized access to information assets, and even modify the database and its configuration information, creating false users with access rights. Inter-host workflow attacks may cause changes in the flow of information, and threat sources may modify transmitted data or inject malicious code to affect the authentication of users in the database to obtain higher levels of access. The intermediate nodes involved in the intrusion process comprise network basic equipment and a server, wherein the network basic equipment comprises an enterprise firewall k1Enterprise local area network (IDS) k2Engineering workstation k4Industrial Control System (ICS) firewall k5Industrial controlled local area network (IDS) k6Main data recording system k7Control room workstation k8(ii) a The server comprises a database server k3. Setting the vulnerability degree d of the intermediate node vulnerability according to the vulnerability of the intermediate nodekIf set to k1Degree of vulnerability d1＝0.1，k2Degree of vulnerability d2＝0.2，k3Degree of vulnerability d3＝0.2，k4Degree of vulnerability d4＝0.1，k5Degree of vulnerability d5＝0.2，k6Degree of vulnerability d6＝0.2，k7Degree of vulnerability d7＝0.3，k8Degree of vulnerability d80.1. Then, according to fig. 1, the vulnerability d of the intermediate node k (where k is 1,2, …,8) in the threat path of the threat path and the threat source j (where j is 1,2,3) invading the information asset i (where i is 1,2, …,7) is determinedkjiA value of (1), wherein
In the above equation, i is 2,3, …, 7. The greater the vulnerability value, the higher the probability that the intermediate node will be successfully invaded by the threat source.
The output result of the method is divided into two parts, namely a threat map which is used for carrying out behavior analysis on the attack faced in an industrial control system and determining a threat path of a threat source invading an object to be protected; the risk value is used for evaluating the risk of the industrial control system, and is compared with a preset risk threshold value, if the value is lower than the preset risk threshold value, the threat faced by the industrial control system is in an acceptable range; if the risk value is higher than the preset risk threshold, the risk that the industrial control system is attacked is indicated, and the vulnerability degree of the intermediate node can be reduced by adding or replacing protective measures of the intermediate node so as to reduce the risk value to be lower than the preset risk threshold.
Generating a threat map of the industrial control system information asset according to the threat source, the position of the object to be protected and the intermediate node set in the previous 3 steps, wherein lines of different types represent threat paths of different threat sources j invading the object i to be protected, and the numerical value of each section of the threat path connected with the intermediate node is the probability of the threat source successfully invading the intermediate node, namely the vulnerability d of the intermediate nodekjiThe numerical value of each section connecting the position of the object to be protected is pi which is the probability that the threat source successfully invades the object to be protectedm(dkji) And m is the total number of the intermediate nodes in the threat path. According to the initially set threat source j, the object i to be protected and the value v thereofiIntermediate node k of threat path and its vulnerability dkjiCalculating the risk value R of the industrial control system by using the formula 1ICS. The risk value indicates the risk degree of the industrial control system, and the obtained risk value RICSThe larger the risk degree of the industrial control system is, the larger the threat to the information assets is. R is obtained according to the set numerical valueICS0.089351, performing risk assessment on the industrial control system by comparing with a preset risk threshold value, wherein the preset risk threshold value is the highest acceptable risk value and is determined according to the actual situation, and if the risk threshold value is set to be Rt＝0.1，RICS＜RtThe industrial control system faces the threats within the acceptable range.
According to the industrial control system risk quantitative analysis method based on the threat map, the threat map in the form of the cognitive map is established according to the behavior analysis of the industrial process in the industrial control system, the threat map describes the potential threat and source of the information assets in the industrial control system based on the form of the cognitive map, and the behavior analysis in the industrial process can be effectively supported. The method comprises the steps of establishing a threat map, determining 3 types of elements which are respectively a threat source, a position of an object to be protected and a middle node of a threat path, further providing a formula for quantizing an information asset risk value of the industrial control system on the basis of the threat map, calculating the risk degree of the information asset in the industrial control system according to the value of the information asset and the fragility degree of the middle node of the threat path by the formula for risk assessment of the industrial control system, comparing the information asset risk value calculated by the formula with a preset risk threshold value, judging whether the threat faced by the industrial control system is in an acceptable range, if not, increasing or replacing protective measures of the nodes in the threat path according to actual conditions, and reducing the risk of the industrial control system to the acceptable level. The industrial control system risk quantitative analysis method based on the threat map provided by the invention is based on the behavior in the industrial flow, the essential cause and the internal interaction relation of the safety problem of the industrial control system are explored, the possible risks and sources of the industrial control system in the industrial flow are intuitively reflected in the form of the threat map, the information asset value and the influence strength of the vulnerability of industrial control equipment on the safety of the industrial control system are objectively analyzed by means of quantitative analysis, and the errors and defects in subjective judgment are avoided, so that the risk degree of the industrial control system is more accurately evaluated.
Although illustrative embodiments of the present invention have been described above to facilitate the understanding of the present invention by those skilled in the art, it should be understood that the present invention is not limited in scope to the specific embodiments. Such variations are obvious and all the inventions utilizing the concepts of the present invention are intended to be protected.
Claims (4)
1. A risk quantitative analysis method for an industrial control system based on a threat map is characterized by comprising the following steps: the method comprises the following steps:
s1), performing behavior analysis on the attack faced by the industrial process in the industrial control system, and determining 3 types of elements for establishing a threat map according to the actual environment of the industrial control system: the system comprises a threat source, an object to be protected and an intermediate node, wherein the object to be protected is an information asset which needs to be protected by the industrial control system, a line from the threat source to the position of the object to be protected through the intermediate node is a threat path generating a threat, and a threat map based on a cognitive map form is established according to the 3 types of elements;
s2) according to the threat map obtained in the step S1), constructing an information asset risk value formula of the industrial control system:
this formula is used to quantify the risk faced by the industrial control system, where viRepresents the value, Σ, of an information asset invnThe total value of the information assets in the industrial control system; dkjiThe vulnerability of an intermediate node k in a threat path for a threat source j to intrude into an information asset i, wherein k is the number of the intermediate node and dkjiThe value interval of (1) is (0); m is the total number of intermediate nodes in the threat path of the threat source j invading the information asset i; i, j, m and n are positive integers;
s3) carrying out risk assessment on the industrial control system according to the risk value calculated by the information asset risk value formula of the industrial control system in the step S2): comparing the calculated risk value with a preset risk threshold, and if the calculated risk value is lower than the preset risk threshold, indicating that the threat faced by the industrial control system is within an acceptable range; if the calculated risk value is higher than the preset risk threshold, it indicates that the industrial control system faces the attacked risk, and at this time, the vulnerability of the intermediate node in the threat path needs to be reduced by adding or replacing a protection measure of the intermediate node in the threat path, so as to reduce the risk value to be below the preset risk threshold.
2. The method for quantitative risk analysis of industrial control system based on threat map as claimed in claim 1, wherein in said step S1), according to the possibility of threat generation, dividing said threat sources into 4 levels of a1, b1, c1 and d1, and ranking the threat levels of a1< b1< c1< d1, wherein:
a1 represents an external attacker: potential attackers in the external network environment;
b1 represents the remote user: internal users through remote access;
c1 denotes the local area network internal user: the users are positioned in the industrial control system local area network;
d1 represents the authorized user of the industrial control system: the industrial control system authorizes the user and can directly access and use the industrial control system equipment.
3. The method for quantitatively analyzing risks of industrial control system based on threat map as claimed in claim 2, wherein in said step S1), said information assets are classified into 4 types according to categories: operational data, instruction information, configuration information, and software information;
in the industrial process, the positions of different types of information assets are different, and the positions of the information assets and the types of the information assets at the positions comprise:
a2. a data server: operational data in the data server;
b2. programmable Logic Controller (PLC): software information for realizing PLC algorithm in PLC;
c2. OLE (OLE) for Process Control server for Process Control: instruction information in an OPC server;
d2. data Acquisition And Supervisory Control (SCADA) server: the operation data in the SCADA server and the instruction information in the SCADA server;
e2. operator Personal Computer (PC): software information for realizing a Human Machine Interface (HMI) in an operator PC;
f2. person Computer (PC) for security management: configuration information in the personnel PC is managed;
in the above a2-f2, the left side of the colon indicates the location of the information asset, and the right side of the colon indicates the type of information asset at the location to the left of the corresponding colon.
4. The method for quantitatively analyzing risks of industrial control system based on threat map according to claim 3, wherein in the step S1), the manner of invading the object to be protected by the threat source through the intermediate node includes:
(1) directly accessing through an equipment interface to carry out physical invasion;
(2) local system intrusion is carried out through local network access;
(3) remote invasion is carried out through remote network access;
the network facilities involved in the intrusion mode are intermediate nodes of the threat path, and the intermediate nodes are divided into two types, namely network basic equipment and a server, and specifically comprise:
a3. network infrastructure equipment: routers, switches, firewalls, Virtual Private Networks (VPNs), Intrusion Detection Systems (IDS), master data recording Systems, workstations;
b3. a server: a sparse zone (DMZ) server, a database server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910686625.0A CN110493200B (en) | 2019-07-29 | 2019-07-29 | A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910686625.0A CN110493200B (en) | 2019-07-29 | 2019-07-29 | A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110493200A CN110493200A (en) | 2019-11-22 |
| CN110493200B true CN110493200B (en) | 2021-06-01 |
Family
ID=68548313
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910686625.0A Active CN110493200B (en) | 2019-07-29 | 2019-07-29 | A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110493200B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115499238B (en) * | 2022-09-30 | 2023-04-28 | 北京珞安科技有限责任公司 | Industrial control network threat analysis method based on industrial control behavior analysis |
| CN115600218B (en) * | 2022-11-16 | 2023-03-21 | 北京融数安科技有限公司 | Industrial control program risk detection method and system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101351784A (en) * | 2005-12-30 | 2009-01-21 | 阿西式·A·潘迪亚 | Runtime Adaptive Search Processor |
| CN106845872A (en) * | 2017-03-10 | 2017-06-13 | 国网湖南省电力公司 | Mountain fire disaster power network multiple faults fire extinguishing on a large scale equipment method for arranging and system |
| WO2018045073A1 (en) * | 2016-08-30 | 2018-03-08 | Kivu Consulting, Inc. | Systems and methods for identifying and mapping sensitive data on an enterprise |
| US10325093B1 (en) * | 2016-12-07 | 2019-06-18 | Symantec Corporation | Techniques for protecting against unauthorized tech support calls |
| EP3502943A1 (en) * | 2017-12-22 | 2019-06-26 | Wipro Limited | Method and system for generating cognitive security intelligence for detecting and preventing malwares |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10521358B2 (en) * | 2014-06-20 | 2019-12-31 | Hewlett Packard Enterprise Development Lp | System, apparatus and method for prioritizing the storage of content based on a threat index |
| CN106951987B (en) * | 2017-03-10 | 2017-12-15 | 国网湖南省电力公司 | More fire point power grid risk matrixes increase null transformation Quick rescue method and system |
-
2019
- 2019-07-29 CN CN201910686625.0A patent/CN110493200B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101351784A (en) * | 2005-12-30 | 2009-01-21 | 阿西式·A·潘迪亚 | Runtime Adaptive Search Processor |
| WO2018045073A1 (en) * | 2016-08-30 | 2018-03-08 | Kivu Consulting, Inc. | Systems and methods for identifying and mapping sensitive data on an enterprise |
| US10325093B1 (en) * | 2016-12-07 | 2019-06-18 | Symantec Corporation | Techniques for protecting against unauthorized tech support calls |
| CN106845872A (en) * | 2017-03-10 | 2017-06-13 | 国网湖南省电力公司 | Mountain fire disaster power network multiple faults fire extinguishing on a large scale equipment method for arranging and system |
| EP3502943A1 (en) * | 2017-12-22 | 2019-06-26 | Wipro Limited | Method and system for generating cognitive security intelligence for detecting and preventing malwares |
Non-Patent Citations (2)
| Title |
|---|
| 《Threats Modeling and Quantitative Risk Analysis in Industrial Control Systems》;Irina Mashkina等;《2018 International Russian Automation Conference (RusAutoCon)》;20180916;正文1-5 * |
| 《移动智能终端安全评估技术研究及在Android平台下的实现》;逯全芳;《中国优秀硕士学位论文全文数据库信息科技辑》;20160315;第2016卷(第03期);正文73-138页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110493200A (en) | 2019-11-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Yang et al. | Harmonizing safety and security risk analysis and prevention in cyber-physical systems | |
| CN107819771B (en) | Information security risk assessment method and system based on asset dependency relationship | |
| Rubio et al. | Analysis of Intrusion Detection Systems in Industrial Ecosystems. | |
| CN115996146A (en) | Numerical control system security situation awareness and analysis system, method, equipment and terminal | |
| CN109739203B (en) | Industrial network boundary protection system | |
| Matsuda et al. | Cyber security risk assessment on industry 4.0 using ics testbed with ai and cloud | |
| CN117056951A (en) | Data security management method for digital platform | |
| Eid et al. | IIoT network intrusion detection using machine learning | |
| CN110493200B (en) | A Quantitative Analysis Method of Industrial Control System Risk Based on Threat Map | |
| CN117763525A (en) | Mobile terminal information safety protection system and method | |
| CN113422776A (en) | Active defense method and system for information network security | |
| Liu et al. | SEAG: A novel dynamic security risk assessment method for industrial control systems with consideration of social engineering | |
| Bindra et al. | Security in cyber physical systems: Transformation and challenges | |
| Goyal et al. | Beyond the Basics: A Study of Advanced Techniques for Detecting and Preventing SQL Injection Attacks | |
| Mahlous | Security Analysis in Smart Agriculture: Insights from a Cyber-Physical System Application. | |
| CN119728211A (en) | An unmanned inspection and intelligent fault judgment method | |
| Teymourlouei | A machine learning approach to the evaluation of zero trust compliance in network infrastructure | |
| George | Artificial Intelligence-Powered Cybersecurity: The Future of How Threats Are Detected and Responded | |
| McCall | Cybersecurity in the Age of AI and IoT: Emerging Threats and Defense Strategies | |
| Shaaban et al. | Rule-based approach using Threatget for automatically generating attack paths in industrial automation and control systems | |
| Bin Ahmad et al. | Using genetic algorithm to minimize false alarms in insider threats detection of information misuse in windows environment | |
| Stodt et al. | Trust management system for hybrid industrial blockchains | |
| Nia et al. | A software solution for realtime malware detection in distributed systems | |
| Mumtaz et al. | Evolutionary Algorithms and AI in Cybersecurity: Adaptive Threat Mitigation Strategies Using Big Data and IoT | |
| Lahno | Protection of information in critical application data processing systems |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |