中圖分類號：TP309 文獻標識碼：ADOI:10.19358/j.issn.2097-1788.2024.04.001
引用格式：劉子龍，周純杰，胡曉婭,等.基于貝葉斯攻擊圖的油氣生產物聯(lián)網(wǎng)系統(tǒng)風險評估［J］.網(wǎng)絡安全與數(shù)據(jù)治理，2024，43（4）：3-11，23.

Risk assessment of oil and gas production IoT system based on Bayesian attack graph

Abstract： Aiming at the dynamic risk assessment of oil and gas production IoT system, a risk assessment model of oil and gas production IoT system based on Bayesian attack graph was proposed. Firstly, through the risk analysis of the system, the intrusion evidence and system vulnerabilities are obtained, combined with the intrusion evidence and the success probability of vulnerability exploitation, the EM algorithm is used to complete the data of the training data and dynamically update the conditional probability parameter table of the Bayesian attack graph, the prior probability can be calculated through the conditional probability table, and the posterior probability of the node is calculated by combining the intrusion evidence, then the risk value of the system is obtained, and the risk value is finally corrected considering the correlation of resource utilization. The simulation results have proved the effectiveness and accuracy of the model.

Key words : Bayesian attack diagram; Bayesian parameter learning; valueatrisk calculation; risk value correction