关键词: 工业控制网络, 网络安全, 风险评估, 攻击图, 隐马尔科夫模型

Abstract: In order to evaluate the network security risk of industrial control system and realize the effective defense of industrial control system, a risk assessment method based on attack graph and HMM is proposed to describe the network security status according to the change of attack behavior. Firstly, the industrial control network attack graph model is established, and the network attack is transformed into the network state migration problem. The network node association (NNC) is introduced to study the association of the industrial control network nodes, and further analyze the network security risks. Then the HMM establishes the relationship between network observation and attack state, and introduces the CVSS evaluation system to evaluate the security status of the industrial control system. Finally, a case study is carried out with the centralized control system of thermal power plant as the experimental background. The analysis results show that the method can comprehensively analyze the safety hazards of industrial control systems and provide a basis for safety management personnel to take effective preventive measures.

Key words: industrial control network, network security, risk assessment, attack map, hidden Markov models