关键词: 工控系统漏洞, 属性判别, ERNIE模型, 风险评价指标, 量化评估

Abstract: In order to solve the problem that the industrial control system vulnerability risk assessment is simple and not closely related to the industrial control environment, a multi-dimensional attri- bute analysis method of industrial control system vulnerability is proposed. Firstly, a template for discriminating vulnerability attack effectiveness and risk category attributes is established, and multi- dimensional evaluation indicators for the degree of risk vulnerability are defined. Secondly, an automat- ed prediction model of risk level based on ernieCat is proposed, which uses the fusion features of vulnerability text descriptions and the intrinsic evaluation attributes of vulnerabilities to predict the seriousness level, hazard level and exploitability level of industrial vulnerabilities. Besides, this paper combines device-level critical information of industrial control system with vulnerability-level risk situations, and establishes multi-dimensional quantitative evaluation indicators to quantitatively assess the risk hazard level for industrial control system vulnerabilities. Experimental results show that the ernieCat model is superior for predicting vulnerability risk level. 

Key words: industrial control system vulnerability, discrimination of attribute, ERNIE model, risk assessment metrics, quantitative assessment