A kind of Information Security Risk Assessment Methods of industrial control system
Technical field
The present invention relates to field of information security technology, comment more particularly, to a kind of Information Security Risk of industrial control system
Estimate method.
Background technique
Industrial control system (Industrial Control System, abbreviation ICS) is widely used in petrochemical industry, hands over
In the national critical infrastructures such as logical transport, water process.As the development and " two change " fusion of information technology are goed deep into, tradition
Industrial control system and IT system, or even connect with Internet more and more closer, the security threat for causing ICS to face is continuous
Increase.
Since in recent years, the overall size of industrial control system gradually expands, and security level associated therewith also obtains
General Promotion.However should not ignore, industrial control system under the new situation remains difficult to eliminate Information Risk from source, therefore in visitor
Where the value for embodying risk assessment in sight.Information security risk evaluation applies to industrial control system at this stage, facilitates
Risk is judged and identified in the shorter period rapidly, then adequate measures is selected to be subject to prevention and control.It can be seen that information is pacified
Full assessment should be realized with the normal operation of industrial control system and is intimately associated, and can just be dedicated to preventing under the premise of the two combines comprehensively
It controls risk and eliminates wherein potential loophole.
For the whole system of Industry Control, risk assessment itself has the feature of architecture, thus constitutes and be
System engineering.From the point of view of essential characteristic, the core of risk assessment be to estimate industrial control system due to by various outside threats or
Resource lacks and bring evapotranspiration, is dedicated to assessing tender spots and threat degree in whole system under the premise of this.It opens
Open up comprehensive risk assessment, objective is to verify wherein potential every risk and crisis, thus adaptation to local conditions provide it is feasible
Property stronger security strategy, ensure safe operation.So under this kind of background, how to find and corresponding accurately comment
The method of estimating becomes urgent problem to be solved in present practice circle and academia.
Error backpropagation algorithm (Back Propagation, abbreviation BP) include signal propagated forward and error it is anti-
To propagate two processes, i.e., calculating error output when by from be input to output direction carry out, and adjust weight and threshold value then from
The direction for being output to input carries out.When forward-propagating, input signal acts on output node by hidden layer, by non-linear change
Generation output signal is changed, if reality output is not consistent with desired output, is transferred to the back-propagation process of error.Error-duration model is
By output error by hidden layer to the layer-by-layer anti-pass of input layer, and error distribution is given to all units of each layer, to obtain from each layer
Error signal as adjustment each unit weight foundation.By adjusting the linking intensity and hidden layer of input node and hidden node
The linking intensity and threshold value of node and output node, make error along gradient direction decline, by repetition learning training, determine with
The corresponding network parameter of minimal error (weight and threshold value), training stop stopping.Trained neural network can at this time
To the input information of similar sample, the smallest information by non-linear conversion of output error is voluntarily handled.BP neural network is
Most widely used prediction model, but there are two obvious disadvantages for the model: first is that easily falling into local minimum;Second is that convergence speed
Degree is slow.A kind of method for overcoming disadvantages mentioned above is optimized using Genetic Algorithms (Genetic Algorithm, genetic algorithm)
BP neural network prediction model.The randomness defect in BP neural network connection weight and threshold value selection is made up with GA, not only
The extensive mapping ability of BP neural network can be played, and makes BP neural network that there is faster convergence and stronger study
Ability.
Summary of the invention
It is an object of the present invention to overcome the above-mentioned drawbacks of the prior art and provide a kind of industrial control systems
Information Security Risk Assessment Methods.
The purpose of the present invention can be achieved through the following technical solutions:
A kind of Information Security Risk Assessment Methods of industrial control system, comprising the following steps:
S1, the multiple groups assessment score for obtaining risk assessment value and its corresponding multiple risk assessment elements, as initial sample
Data set;
S2, initial sample data set is handled using KPCA, principal component is chosen according to contribution rate of accumulative total, after obtaining dimensionality reduction
Sample data set;
S3, using the sample data set after dimensionality reduction as training sample, the BP neural network of training genetic algorithm optimization obtains
Risk evaluation model;
S4, the assessment score of multiple risk assessment elements is inputted in risk evaluation model, obtains the pre- of risk assessment value
Measured value.
Preferably, the contribution rate of accumulative total is not less than 90%.
Preferably, the step S3 is specifically included:
S31, population scale is set as P, generate the initial population W=(W of P individual at random1,W2,...,WP)T, give one
Data select range, generate individual W in population using linear interpolation functioniA real vector w1,w2,...,wSAs something lost
One chromosome of propagation algorithm, using real number coding method;
S32, the evaluation function for determining individual: giving a BP neural network evolution parameter, will contaminate obtained in step S31
Colour solid carries out assignment to BP neural network weight and threshold value, and input training sample carries out neural metwork training, reaches the essence of setting
Network training output valve is obtained after degree, using training error quadratic sum as population W in individual WiFitness;
S33, using roulette method selection operator, i.e., the selection strategy based on fitness ratio is to the dye in every generation population
Colour solid is selected, select probability are as follows:
Wherein: fiFor fitness value inverse;
S34, crossover operation, k-th of gene w are carried out using real number interior extrapolation methodkWith first of gene wkIn j crossover operations
It is respectively as follows:
wkj=wkj(1-b)+wljB,
wlj=wlj(1-b)+wkjb
Wherein, random number of the b between [0,1];
S35: mutation operation: j-th of gene for choosing i-th of individual carries out mutation operation, it may be assumed that
F (g)=r2(1-g/Gmax)
Wherein: wmaxAnd wminRespectively gene wijThe bound of value, random number of the r between [0,1], r2It is random for one
Number, g are current iteration number, GmaxFor maximum evolutionary generation;
S36, the optimum individual for obtaining genetic algorithm are decomposed into the connection weight and threshold value of BP neural network, in this, as
The initial weight and threshold value of risk evaluation model.
Preferably, momentum term coefficient is 0.75 during the BP neural network of the trained genetic algorithm optimization, maximum
Frequency of training is 15000 times, target error 0.0002.
Preferably, the risk assessment element includes enterprise management level element, process control station element and field control layer
Element.
Preferably, the enterprise management level element includes: unauthorized access, malicious code, distributed denial of service, virus
Wooden horse and forgery attack;The process control station element includes: that Denial of Service attack, dos attack, extensive aggression, response are cheated
With direction misdirecting attack;The field control layer element includes: physical attacks, information stealth, data tampering, Denial of Service attack
It hits, unauthorized access and Replay Attack.
Compared with prior art, the present invention is based on KPCA-GA-BP to industrial control system information security risk evaluation, removes
It is predicted using ordinary BP nerve network, also it is optimized using genetic algorithm, searches out optimal initial weight and threshold
Value, the problem of keeping conventional model accuracy and generalization ability more preferable, not only improve parameter selection in neural network, also effectively mentions
The Evaluation accuracy of high risk assessment models, which is the combination of conventional modeling and intelligent method, to Industry Control
System has great importance.
Detailed description of the invention
Fig. 1 is the method for the present invention flow chart;
Fig. 2 is industrial control system risk elements structure chart in the present invention;
Fig. 3 be embodiment in tri- kinds of BP neural network, KPCA-BP neural network and KPCA-GA-BP of the present invention models most
Whole training result curve graph;
Fig. 4 be embodiment in tri- kinds of BP neural network, KPCA-BP neural network and KPCA-GA-BP of the present invention models most
Training relative error curve graph eventually;
Fig. 5 be embodiment in tri- kinds of BP neural network, KPCA-BP neural network and KPCA-GA-BP of the present invention models most
Training the number of iterations figure eventually.
Specific embodiment
The present invention is described in detail with specific embodiment below in conjunction with the accompanying drawings.The present embodiment is with technical solution of the present invention
Premised on implemented, the detailed implementation method and specific operation process are given, but protection scope of the present invention is not limited to
Following embodiments.
Embodiment
The application proposes a kind of Information Security Risk Assessment Methods of industrial control system, according to industrial control system information
Safety-related standard analysis influences the factor of information security, and establishes corresponding structural model, determine each specific factor and by
Expert estimation assigns a value;KPCA processing is carried out to risk elements, and extracts principal component and obtains the sample data after dimensionality reduction;
Then risk evaluation model is obtained to GA-BP network training by sample data.
As shown in Figure 1, this method specifically includes the following steps:
S1, the multiple groups assessment score for obtaining risk assessment value and its corresponding multiple risk assessment elements, as initial sample
Data set;
According to " GB/T 35673-2017. industrial communication network network and system security technology safety requirements and safety etc.
Grade " and " GB/T 36466-2018 information security technology industrial control system risk assessment implementation guide " and industrial control system
Three Tiered Network Architecture, 16 risk assessment elements are listed, as shown in Fig. 2, including that enterprise management level element, process control station are wanted
Element and field control layer element;Enterprise management level element includes: unauthorized access, malicious code, distributed denial of service, virus
Wooden horse and forgery attack;Process control station element includes: Denial of Service attack, dos attack, extensive aggression, response is cheated and side
To misdirecting attack;Field control layer element includes: physical attacks, information stealth, data tampering, Denial of Service attack, illegal visit
It asks and Replay Attack;
In the present embodiment, the object of risk assessment is this 16 elements, and the value-at-risk of each element is by expert according to industry
" GA/T 1390.5-2017 information security technology network safety grade protects the 5th part of basic demand: industrial control system to standard
Security extension requirement " in the classification of risks standard that proposes specifically assessed, and characterized with integer of 1 to 10.
S2, initial sample data is handled using core principle component analysis (KPCA), principal component is chosen according to contribution rate of accumulative total,
Sample data set after obtaining dimensionality reduction in the present embodiment, extracts the contribution rate of accumulative total of principal component not less than 90%.
S3, the BP neural network for optimizing the sample data set after dimensionality reduction as training sample, training genetic algorithm (GA),
The pattern of fusion regression model based on BP neural network, i.e. GA-BP risk evaluation model are constructed, the survey of risk evaluation model is improved
Accuracy, specifically includes the following steps:
S31, population scale is set as P, generate the initial population W=(W of P individual at random1,W2,...,WP)T, give one
Data select range, generate individual W in population using linear interpolation functioniA real vector w1,w2,...,wSAs GA
A chromosome, high-precision weight and threshold value in order to obtain, using real number coding method;
S32, the evaluation function for determining individual: giving a BP neural network evolution parameter, will contaminate obtained in step S31
Colour solid carries out assignment to BP neural network weight and threshold value, and input training sample carries out neural metwork training, reaches the essence of setting
Network training output valve is obtained after degree, using training error quadratic sum as population W in individual WiFitness;
S33, using roulette method selection operator, i.e., the selection strategy based on fitness ratio is to the dye in every generation population
Colour solid is selected, select probability are as follows:
Wherein: fiFor fitness value inverse;
S34, real coding is used due to individual, crossover operation method uses real number interior extrapolation method, k-th of gene wkWith l
A gene wkIt is respectively as follows: in j crossover operations
Wherein, random number of the b between [0,1];
S35: mutation operation: j-th of gene for choosing i-th of individual carries out mutation operation, it may be assumed that
F (g)=r2(1-g/Gmax)
Wherein: wmaxAnd wminRespectively gene wijThe bound of value, random number of the r between [0,1], r2It is random for one
Number, g are current iteration number, GmaxFor maximum evolutionary generation;
S36, the optimum individual for obtaining genetic algorithm are decomposed into the connection weight and threshold value of BP neural network, in this, as
The initial weight and threshold value of risk evaluation model obtain the corresponding regression function of risk evaluation model.
S4, the assessment score of multiple risk assessment elements is inputted in risk evaluation model, obtains the pre- of risk assessment value
Measured value.
It obtains 15 groups in the present embodiment for the validity for verifying modeling method and outputs and inputs data as nerve net
The learning sample of network.As shown in table 1, there are 16 risk assessment elements point (F1~F16) and the assessed value of 15 application systems, grade
It is not to be divided according to assessed value size, the object of risk assessment is this 16 elements.
1 15 systematic sample data of table
Table 2 is the specific data that KPCA analyzes result, as can be seen from Table 2, when proceeding to the 6th Principle component extraction,
Accumulative principal component contribution proportion total value has been above 90%, can represent 90% information of original 16 elements, so with
The data set that this 6 principal components generate replaces initial data as training sample, and this 6 principal components are irrelevant 6
A principal component.
2 KPCA of table analyzes result
In order to verify the validity based on KPCA-GA-BP Information Security Risk Assessment Methods of the application proposition, this implementation
Example carries out this method with based on BP neural network, the Information Security Risk Evaluation Model obtained based on KPCA-BP neural network
Comparative analysis.In the present embodiment, BP neural network, which uses, has training method of the momentum gradient descent method as network, and sets
Traingdm function is training function.Performance function is MSE function.Momentum term coefficient=0.75, maximum frequency of training are 15000
It is secondary, target error 0.0002.Sample data of the 12 groups of data of front as correlation training in table 1, is used for BP network,
4 groups of data of number 12 to 15 carry out risk data with trained BP network is had already passed through as verifying collection data below
Prediction, the operation being finally normalized obtain output valve.Prediction result can also be compared with truthful data.In order to avoid with
Machine, 3 kinds of models are separately operable 20 times, and prediction result is as shown in Fig. 3,4 and table 3.
The prediction result of the different risk evaluation models of table 3
Can be obtained by table 3, the range of the relative error rate for the model that this method obtains is 0.56%~1.03%, and other two
The relative error rate range of kind model is 1.11%~7.2 4%.So the neural network model obtained based on this method is to wind
The accuracy rate that danger is predicted is promoted, and can carry out risk assessment to industrial control system more accurately.
The operation time of the different risk evaluation models of table 4
Network parameter |
BP model |
KPCA-BP model |
KPCA-GA-BP model |
The number of iterations |
11397 |
4103 |
2384 |
Training time |
67 |
41 |
28 |
By Fig. 5 and table 4, it can be seen that if there is identical error learning objective, it is iterated based on this method modeling
Number and the duration of training are few more many than other two methods, so this method establishes the process of model in convergence rate
On be also improved.