KR102750418B1 - Method and apparatus for providing security threat data in smart factory - Google Patents

Abstract

A method for providing security threat data of a smart factory according to one aspect of the technical idea of the present disclosure comprises the steps of: setting an attack possibility variable based on the security vulnerability severity of each of devices included in the smart factory; generating security threat data representing a security threat to each of the devices based on data generated from the smart factory; setting an impact variable for each of the devices based on the generated security threat data; calculating a security threat risk level for each of the devices based on the set attack possibility variable and impact variable; and providing a visualization model that visualizes the calculated security threat risk level.

Description

{METHOD AND APPARATUS FOR PROVIDING SECURITY THREAT DATA IN SMART FACTORY}

The technical idea of the present disclosure relates to a method and device for providing security threat data of a smart factory.

Due to the 4th industrial revolution, many studies are being conducted on the construction of smart factories that utilize ICT technologies such as artificial intelligence and big data in the manufacturing industry. In smart factories, all objects required for the production process are connected with IIoT (Industrial Internet of Things) technology, a communication system is built, and digitalization is conducted so that ICT technologies such as CPS (Cyber Physical System), big data, cloud, and artificial intelligence can be utilized in the manufacturing industry, thereby automating and optimizing the production process.

However, as devices in smart factories are organically connected, the security threats that may arise from this are also increasing. In the past, security threat data at each level within a smart factory was collected, analyzed, and visualized through SIEM (Security Information and Event Management) equipment to respond, but it was not possible to effectively provide security threat data at all levels of the smart factory.

The task that the present invention seeks to solve is to effectively provide security threat data on equipment at all levels that make up a smart factory.

The task that the present invention seeks to solve is to complement the lack of visibility of conventional visualization techniques for security threat data for smart factories.

In order to achieve the above purpose, a method for providing security threat data of a smart factory according to an aspect of the technical idea of the present disclosure comprises the steps of: setting an attack possibility variable based on the security vulnerability severity of each of devices included in the smart factory; generating security threat data representing a security threat to each of the devices based on data generated from the smart factory; setting an impact variable for each of the devices based on the generated security threat data; calculating a security threat risk level for each of the devices based on the set attack possibility variable and impact variable; and providing a visualization model that visualizes the calculated security threat risk level.

According to one embodiment, the devices are included in a plurality of layers constituting the smart factory, and the step of providing the visualization model may include a step of providing a visualization model that visualizes the security threat risk level for each device included in the plurality of layers constituting the smart factory.

According to one embodiment, the step of providing the visualization model may include the step of setting a heatmap color for each of the devices from heatmap color distribution information according to a security threat risk level; and the step of providing the visualization model by reflecting the set heatmap color.

According to one embodiment, the step of setting the attack probability variable may include the step of analyzing the degree of security vulnerabilities in devices and software included in the smart factory; the step of determining a vulnerability severity corresponding to the analysis result; and the step of setting the attack probability variable for each of the devices included in the smart factory based on the determined vulnerability severity.

According to one embodiment, the vulnerability severity corresponds to a CVSS score calculated by a common vulnerability scoring system (CVSS), and the attack probability variable may be set to a value of a vulnerability grade corresponding to the calculated CVSS score among a plurality of vulnerability grades classified by section of the CVSS score.

According to one embodiment, the step of generating the security threat data may include the step of receiving the data including at least one of a log and a security event occurring from the smart factory; the step of analyzing the received data through a security information and event management (SIEM) solution; and the step of generating security threat data indicating a security threat to each of the devices based on the analysis result.

According to one embodiment, the step of setting the influence variable may include the step of identifying, from a database in which a plurality of security threat data accumulated for devices of a smart factory are stored, security threat data identical to or most similar to the generated security threat data; and the step of obtaining, from the database, information on influence variables corresponding to the identified security threat data, and setting the obtained influence variables as influence variables of the generated security threat data.

According to one embodiment, the step of calculating a security threat risk level for each of the devices may include a step of calculating the security threat risk level through the product of a set attack probability variable and an impact variable.

According to one aspect of the technical idea of the present disclosure, a security threat data providing device connected to a smart factory includes: a communication unit which receives data generated from the smart factory; and a processor which sets an attack possibility variable based on a security vulnerability severity of each of devices included in the smart factory, generates security threat data representing a security threat to each of the devices based on the data received from the smart factory, sets an impact variable for each of the devices based on the generated security threat data, calculates a security threat risk level for each of the devices based on the set attack possibility variable and impact variable, and generates a visualization model visualizing the calculated security threat risk level.

According to the technical idea of the present disclosure, by visualizing and providing a security threat risk level based on security threat data for equipment of all layers constituting a smart factory, it enables a manager to quickly and effectively analyze and respond to an accident.

In addition, since the risk level for each device is visualized and provided based on security threat data, managers can perform more efficient responses according to priority based on risk level.

The effects that can be obtained by the method and device according to the technical idea of the present disclosure are not limited to the effects mentioned above, and other effects that are not mentioned can be clearly understood by a person having ordinary skill in the art to which the present invention belongs from the description below.

To more fully understand the drawings cited in this disclosure, a brief description of each drawing is provided.
FIG. 1 is a conceptual diagram of a system including a smart factory and a security threat data providing device of the smart factory according to an exemplary embodiment of the present disclosure.
Figure 2 is an example diagram showing the architecture structure of the smart factory illustrated in Figure 1.
FIG. 3 is a block diagram showing an example of a control configuration included in the security threat data provision device illustrated in FIG. 1.
Figure 4 is a table showing an example of vulnerability severity levels provided by the security vulnerability diagnosis module illustrated in Figure 3.
FIG. 5 is an example diagram showing a heat map color distribution by risk level calculated based on vulnerability variables and impact variables derived according to an embodiment of the present disclosure.
FIG. 6 is an exemplary diagram showing a heatmap-based security threat data visualization model as an example of a security threat data visualization model generated by a security threat data providing device according to an embodiment of the present disclosure.
FIG. 7 is a flowchart for explaining a method for providing security threat data of a smart factory according to an embodiment of the present disclosure.

The exemplary embodiments according to the technical idea of the present disclosure are provided to more completely explain the technical idea of the present disclosure to those skilled in the art, and the embodiments below may be modified in various different forms, and the scope of the technical idea of the present disclosure is not limited to the embodiments below. Rather, these embodiments are provided to more faithfully and completely convey the technical idea of the present disclosure to those skilled in the art.

Although the terms first, second, etc. are used in the present disclosure to describe various elements, regions, layers, portions, and/or components, it is to be understood that these elements, parts, regions, layers, portions, and/or components should not be limited by these terms. These terms do not imply a particular order, hierarchy, or order, and are only used to distinguish one element, region, portion, or component from another element, region, portion, or component. Accordingly, a first element, region, portion, or component described below may refer to a second element, region, portion, or component without departing from the teachings of the technical idea of the present disclosure. For example, a first element may be referred to as a second element, and similarly, a second element may also be referred to as a first element, without departing from the scope of the present disclosure.

Unless otherwise defined, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the concepts of the present disclosure belong. In addition, terms commonly used, as defined in dictionaries, should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an overly formal sense unless explicitly defined herein.

In some embodiments, where the embodiments are otherwise feasible, a particular process sequence may be performed in a different order than the order described. For example, two processes described in succession may be performed substantially simultaneously, or may be performed in a reverse order from the order described.

In the attached drawings, for example, variations of the shapes depicted may be expected depending on manufacturing techniques and/or tolerances. Therefore, embodiments according to the technical idea of the present disclosure should not be construed as being limited to the specific shapes of the regions depicted in the present disclosure, and should include, for example, changes in shapes resulting from the manufacturing process. The same reference numerals are used for the same components in the drawings, and redundant descriptions thereof are omitted.

The term 'and/or' as used herein includes each and every combination of one or more of the mentioned absences.

Hereinafter, embodiments according to the technical idea of the present disclosure will be described in detail with reference to the attached drawings.

FIG. 1 is a conceptual diagram of a system including a smart factory and a security threat data providing device of the smart factory according to an exemplary embodiment of the present disclosure. FIG. 2 is an exemplary diagram showing the architectural structure of the smart factory illustrated in FIG. 1.

Referring to Fig. 1, a smart factory (100) refers to an intelligent production plant that improves productivity, quality, and customer satisfaction by applying information and communication technology (ICT) combined with digital automation solutions to production processes such as design, development, manufacturing, distribution, and logistics. A smart factory (100) can be built by combining various ICT technologies such as sensors, cloud, big data, precision control, and mobile with existing manufacturing technologies, and has the advantages of improving productivity, saving energy, and implementing a safe production environment by providing an automated and intelligent infrastructure.

Referring to Fig. 2, the smart factory (100) can be configured with a 5-layer architecture, which can be configured through domestic and international smart factory industrial control system standards (RAMI 4.0, ISA/IEC 62443, NIST 800-82, Purdue model, etc.). Among the 5 layers of the smart factory (100), layers 0 to 3 correspond to the operation technology (OT) area, and layers 4 to 5 correspond to the information technology (IT) area.

Layer 0 corresponds to the field device area where various sensors and production equipment (actuators, production robots, etc.) operate.

The first layer is a process control (basic control) area, which may be composed of production control devices that collect status information of field devices and transmit control commands. The production control devices may include controllers such as a programmable logic controller (PLC) and a distributed control system (DCS).

The second layer is a supervisory control area, which may be composed of production operation devices for monitoring and controlling field devices in the 0th layer and control devices in the 1st layer. The production operation devices may include SCADA (supervisory control and data acquisition), HMI (human machine interface), OWS (operator workstation), etc.

Layer 3 may correspond to the production management area, which includes production management and support systems such as MES (manufacturing execution system), Historian, etc. that collect and analyze production information from devices in lower layers and transmit it to upper layers, and transmit production orders from upper layers to lower layers.

Layers 4 and 5 are environments similar to general IT, and can include a work area including work PCs, a public server area including web servers and mail servers, and a server area including ERP (enterprise resource planning), CRM (customer relationship management), groupware, etc.

Meanwhile, such smart factories (100) may have security threats due to the introduction of ICT technology and the connection between the IT and OT areas. For example, an attacker may penetrate the IT area connected from the external Internet and access the OT area through the contact point between the IT and OT areas. After seizing the authority of the production operation device, the attacker may transmit a modified command to the production control device, and damage may occur to the factory as the production device malfunctions due to the modified command.

Attack vectors, which are the paths or methods used by attackers, include attacks through physical access that utilize the characteristics of factory devices physically exposed to the outside, attacks through industrial control systems that form a linkage between devices for process automation, attacks through process control networks that have numerous security vulnerabilities with a focus on availability, and attacks through IT areas connected to OT areas.

These security threats may exist for each layer of the smart factory (100) and for each device in each layer. For example, security threats in layer 0 include physical device damage, process data leakage, malfunction, and interruption, and security threats in layer 1 include process data manipulation and process network failure. Security threats in layer 2 include unauthorized access, arbitrary process manipulation, malware infection, process data and recipe leakage, and security threats in layer 3 include service interruption, ransomware infection, process data and recipe leakage, and security threats in layer 4 and layer 5 include security threats in general IT environments, such as ransomware infection, service failure and interruption, and important information leakage. In particular, the OT area is not sufficiently prepared for security vulnerabilities compared to the IT area, so the difficulty of attack is low, but the damage caused by the attack can be very large.

Let's explain Figure 1 again.

In order to respond to the security threats of the smart factory (100) as described above, the security threat data providing device (200) can generate security threat data through monitoring/analyzing devices in the smart factory (100) and provide a visualized level of risk according to the security threat data. The security threat data providing device (200) can be directly connected to each layer of the smart factory (100) or connected to some layers to perform monitoring/analysis of devices included in each layer. For example, the security threat data providing device (200) can include a SIEM (security information and event management) device (or SIEM software), but is not limited thereto.

The SIEM device can collect logs and event data generated by network hardware, applications, security devices, etc. in a smart factory (100), and analyze the collected data to detect security threats. SIEM corresponds to a security solution that combines SIM (security information management) and SEM (security event management). Specifically, the SIEM device can perform real-time monitoring of security alerts generated by network hardware, applications, security devices, etc. in a smart factory (100), and generate security threat data representing security threats detected through data collection and analysis, event correlation derivation, and/or log management.

In particular, the security threat data providing device (200) according to the embodiment of the present disclosure can derive a security threat risk level based on security threat data for each device included in a smart factory (100) and provide the derived security threat risk level in a visualized form. Accordingly, the manager can quickly identify and respond to security attacks or security accidents of the devices included in the smart factory (100).

FIG. 3 is a block diagram showing an example of a control configuration included in the security threat data providing device illustrated in FIG. 1. FIG. 4 is a table showing an example of vulnerability severities provided by the security vulnerability diagnosis module illustrated in FIG. 3. FIG. 5 is an example diagram showing a heatmap color distribution by risk level calculated based on vulnerability variables and impact variables derived according to an embodiment of the present disclosure. FIG. 6 is an example diagram showing a heatmap-based security threat data visualization model as an example of a security threat data visualization model generated by the security threat data providing device according to an embodiment of the present disclosure.

Referring to FIG. 3, the security threat data providing device (200) may include a communication unit (210), an input unit (220), an output unit (230), a processor (240), and a memory (250). The control configurations illustrated in FIG. 3 are examples for convenience of explanation, and the security threat data providing device (200) may include more or fewer configurations than the configurations illustrated in FIG. 3.

The communication unit (210) may include at least one communication module for connecting the security threat data provision device (200) to the smart factory (100) and receiving logs or event data of devices included in the smart factory (100). The event data may be data on a security event, but is not limited thereto.

According to an embodiment, the communication unit (210) may provide security threat data generated based on the analysis results of received logs or event data to a terminal or server of a security manager or the like, or may provide a visualization model that visualizes the security threat data to a terminal or server of the security manager or the like.

The input unit (220) may include at least one input means for receiving a command or request from an administrator of the security threat data provision device (200).

The output unit (230) may include at least one output means for outputting various information based on security threat data of devices within a smart factory (100), or various information related to the operation of a security threat data providing device (200), in a visual form, etc. According to an embodiment, the output unit (230) may output a visualization model that visualizes the security threat data according to the level of security threat risk.

The processor (240) can control the overall operation of the security threat data providing device (200). The processor (240) can include hardware such as at least one CPU, GPU, AP, FPGA, ASIC, etc. According to an embodiment, the processor (240) can include a security vulnerability diagnosis module (242), a security threat data generation module (244), a risk calculation module (246), and a visualization module (248), and each module can be configured as software stored in a memory (250) is loaded and executed by the processor (240).

The security vulnerability diagnosis module (242) can diagnose the characteristics and severity of security vulnerabilities for devices included in the smart factory (100). For example, the security vulnerability diagnosis module (242) can include a common vulnerability scoring system (CVSS).

CVSS is one of the elements of CVE (common vulnerability and exposure), a security vulnerability management system of MITRE (MIT Research and Engineering), and is a standard for diagnosing and evaluating vulnerabilities through the environment, procedures, and impact of security vulnerabilities. CVSS provides the severity of vulnerabilities by expressing the degree of vulnerabilities analyzed over time and environment as a score.

CVSS basically consists of three metrics, and the details of each metric are as follows.

1) Base metric: This represents a fundamental and essential vulnerability that does not change over time and across users, and is composed of three sub-elements: exploitability, scope, and impact.

i) Exploitability metrics indicate the technical means required to exploit a vulnerability and the ease of exploitation, and are composed of four sub-components: attack vector, attack complexity, required privileges, and user interaction. 'Attack vector' indicates the level of access required to exploit a vulnerability, with the highest score being given to vulnerabilities that can be exploited remotely, and the lowest score being given to vulnerabilities that require physical access. 'Attack complexity' is determined by factors beyond the scope of control that allow an attacker to successfully exploit a vulnerability. Vulnerabilities that require additional effort from an attacker are given a high score, while vulnerabilities that require additional effort are given a low score. 'Required privileges' can be determined by the level of privileges required by an attacker to exploit a vulnerability. Vulnerabilities that require an attacker to obtain administrative privileges may be given a high score, while vulnerabilities that do not require privileges may be given a low score. 'User interaction' indicates whether an attacker requires assistance from other users, and the higher the score, the more likely it is that the attacker can complete a task without external assistance.

ii) The scope metric can indicate the possibility of a vulnerability occurring while interacting with multiple devices within the system (smart factory (100)). If exploitation of one vulnerability is successful and allows access to other parts of the system, the score can increase.

iii) Impact metrics refer to the consequences of an attack and may include sub-factors of confidentiality (the amount of data an attacker can access after an exploit), integrity (the extent to which an attacker can manipulate data in the system), and availability (the availability of the system to authorized users after an attack).

2) Temporal metric: This indicates the characteristics of a vulnerability that change over time rather than depending on the user's environment, and may include the maturity of the exploit code, response level, and reporting reliability.

3) Environmental metric: This indicates characteristics that take into account the user's environment (importance of IT assets, mitigation efforts for managing the organization's vulnerabilities, etc.), and the basic CVSS score can be adjusted according to the environmental metric.

Referring to FIG. 4 together, the security vulnerability diagnosis module (242) can diagnose the degree of security vulnerabilities in devices and software included in the smart factory (100) and express the vulnerability severity corresponding to the diagnosis result as a score (CVSS score, etc.). For example, the vulnerability severity can have a score between 0 and 10 and can be classified into multiple vulnerability grades (e.g., 5 grades based on CVSS 3.1) according to the score range. The higher the score, the higher the vulnerability severity.

The processor (240) may set an attack likelihood variable (Likelihood) for each of the devices of the smart factory (100) based on the vulnerability severity of each of the devices. For example, the processor (240) may set the attack likelihood variable based on the vulnerability severity and vulnerability level described above. Specifically, the processor (240) may set the attack likelihood variable to '1' when the vulnerability level is 'None', and may increase the attack likelihood variable by 1 as it goes to 'Critical'. The set attack likelihood variable may be utilized in the security threat risk calculation process of the risk calculation module (246) described below.

According to an embodiment, the security threat data providing device (200) may receive information on the vulnerability severity from a separate device connected through the communication unit (210) and set an attack probability variable based on the received vulnerability severity.

Let's explain Figure 3 again.

The security threat data generation module (244) can collect logs and event data generated by network hardware, applications, security devices, etc. within the smart factory (100), analyze the collected data, and generate security threat data indicating security threats to each device within the smart factory (100). As described above, the security threat data generation module (244) can correspond to a SIEM solution, but is not limited thereto.

The processor (240) can derive an impact variable (Impact) that indicates the degree to which the system is affected by an attack corresponding to the security threat data based on the generated security threat data. For example, the impact variable (Impact) can be composed of multiple levels, and the example below shows a form in which the impact variable is composed of four levels, and the impact variable has a value of one of 1 to 4 depending on each level.

1) Level 1: This refers to a case where minimal systems are affected or software malfunctions causing minimal impact, and simple incident response solutions exist. Examples include custom content errors and documentation errors.

2) Level 2: This means that only some systems are affected or only functions that do not affect software operation are unavailable, and there is an incident response solution. This includes running time delays and application operation errors.

3) Level 3: This refers to a case where a significant number of critical functions of a system or software are affected or performance is significantly degraded, affecting normal system operation, and an incident response solution exists. This includes application load failures, deployment failures, and performance degradation affecting users.

4) Level 4: In the event of a production or system failure, there is no incident response solution, so the operation must be stopped and a response solution must be studied. This includes the forced termination of all event correlation analysis functions, failure of upgrades or patches, and inability to use the user interface.

Meanwhile, the above-mentioned influence variable may be obtained through a database (not shown) that stores a plurality of security threat data accumulated for each device of the smart factory (100) and data (influence variable) derived by dividing the degree to which the system (smart factory (100)) is affected by an attack corresponding to each of the security threat data into predetermined levels. That is, the processor (240) can identify the security threat data generated for each of the devices as the security threat data that is identical or has the highest degree of similarity among the plurality of security threat data stored in the database, and set the influence variable of the identified security threat data as the influence variable of the generated security threat data.

The risk calculation module (246) can calculate the security threat risk (Risk) for each device in the smart factory (100) based on the attack possibility variable (Likelihood) and the impact variable (Impact) described above. For example, the security threat risk (Risk) can correspond to the product of the attack possibility variable (Likelihood) and the impact variable (Impact).

The visualization module (248) can generate a visualization model that visualizes the security threat risk calculated by the risk calculation module (246). For example, the visualization module (248) can visualize the security threat risk for each device of the smart factory (100) by applying a heatmap visualization technique.

Referring to FIGS. 5 and 6, the visualization module (248) can generate a visualization model (600) for the security threat risk of each device of the smart factory (100) based on the heat map color distribution according to the security threat risk. The heat map color distribution can be formed so that the color, saturation, and/or brightness change according to the security threat risk. The visualization module (248) can set a heat map color for each device based on the security threat risk calculated for each device, and generate a visualization model (600) by reflecting the set heat map color.

The processor (240) can output the generated visualization model (600) through the output unit (230) or transmit it to another terminal or server, etc. through the communication unit (210). Referring to the visualization model (600) illustrated in FIG. 6, the visualization module (248) can display the security threat risk of devices included in all layers on the architecture structure of the smart factory (100) described above in FIG. 2 as a heat map (602, 604, 606, 608, 610, 612). Based on the displayed heat map (602, 604, 606, 608, 610, 612), the manager can recognize that the security threat risk of the conversion device in the 0th layer, the switch in the 2nd layer, and the MES in the 3rd layer are high. In addition, the manager can recognize that the security threat risk for the data acquisition (DAQ) equipment of the first layer, the HMI of the second layer, and the WAS (web application server) of the fourth to fifth layers is at a medium level. That is, the security threat data provision device (200) provides the security threat risk based on the security threat data of the devices included in all layers of the smart factory (100) through a heat map-based visualization model (600), thereby enabling the manager to quickly detect and respond to security threats to the devices included in the smart factory (100).

According to an embodiment, the visualization module (248) may display the security threat risk level of each device as a heat map on a drawing, such as an actual layout diagram of devices within a smart factory (100), instead of the above-mentioned architectural structure.

The memory (250) can store various commands or data related to the operation of the security threat data providing device (200). For example, the memory (250) can store security threat data received from the smart factory (100), and algorithms or program data for generating a visualization model that visualizes the security threat risk level for each device of the smart factory (100) based on the security threat data. The memory (250) can include at least one volatile/nonvolatile memory.

FIG. 7 is a flowchart for explaining a method for providing security threat data of a smart factory according to an embodiment of the present disclosure.

Referring to FIG. 7, the security threat data provision device (200) can set an attack possibility variable (Likelihood) based on the vulnerability severity (CVSS score, etc.) of each device of the smart factory (100) (S700).

The security threat data providing device (200) can generate security threat data for each of the devices based on logs and event data generated from devices and/or applications of the smart factory (100) (S710). The security threat data providing device (200) can set an impact variable (Impact) for each of the devices based on the generated security threat data (S720).

The security threat data provision device (200) can calculate the security threat risk level (Risk) for each device in the smart factory (100) based on the set attack possibility variables and impact variables (S730). The security threat data provision device (200) can provide the calculated security threat risk level by visualizing it in the form of a heat map, etc. (S740).

The description of the above embodiments is merely provided as examples with reference to the drawings for a more thorough understanding of the present disclosure, and should not be construed as limiting the technical idea of the present disclosure.

In addition, it will be apparent to a person skilled in the art that various changes and modifications can be made without departing from the basic principles of the present disclosure.

Claims (16)

In the method of providing security threat data for smart factories,
A step of setting an attack possibility variable based on the severity of security vulnerabilities of each device included in the above smart factory;
A step of generating security threat data indicating a security threat to each of the devices based on data generated from the smart factory;
A step of setting an impact variable for each of the devices based on the generated security threat data;
A step of calculating the security threat risk level for each of the above devices based on the set attack possibility variables and impact variables; and
Including a step of providing a visualization model that visualizes the generated security threat risk level,
The steps for setting the above influence variables are:
A step for identifying security threat data that is identical to or most similar to the generated security threat data from a database storing a plurality of security threat data accumulated for devices of a smart factory; and
A step of obtaining information on an impact variable corresponding to the identified security threat data from the database and setting the obtained impact variable as an impact variable of the generated security threat data,
method.
In the first paragraph,
The above devices are included in multiple layers that constitute the smart factory,
The step of providing the above visualization model is:
A step of providing a visualization model that visualizes the security threat risk level for each device included in multiple layers constituting the smart factory,
method.
In the first paragraph,
The step of providing the above visualization model is:
A step of setting a heatmap color for each of the devices from heatmap color distribution information according to the security threat risk level; and
comprising a step of providing the visualization model by reflecting the set heatmap color;
method.
In the first paragraph,
The step of setting the above attack probability variable is:
A step of analyzing the degree of security vulnerabilities in devices and software included in the above smart factory;
Step for determining the vulnerability severity corresponding to the analysis results; and
A step of setting an attack probability variable for each device included in the smart factory based on the determined vulnerability severity,
method.
In paragraph 4,
The above vulnerability severity corresponds to the CVSS score calculated by the common vulnerability scoring system (CVSS).
The above attack probability variable is set to the value of the vulnerability grade corresponding to the calculated CVSS score among multiple vulnerability grades classified by CVSS score interval.
method.
In the first paragraph,
The steps for generating the above security threat data are:
A step of receiving the data including at least one of a log and a security event occurring from the smart factory;
Step of analyzing the received data through a SIEM (security information and event management) solution; and
A step of generating security threat data indicating a security threat to each of the devices based on the analysis results,
method.
delete In the first paragraph,
The step of calculating the security threat risk for each of the above devices is:
Including a step of calculating the security threat risk level by multiplying the set attack probability variable and the impact variable.
method.
In a security threat data provision device connected to a smart factory,
A communication unit that receives data generated from the above smart factory; and
Set attack probability variables based on the severity of security vulnerabilities of each device included in the above smart factory,
Based on the data received from the above smart factory, security threat data indicating security threats to each of the above devices is generated,
Based on the generated security threat data, impact variables are set for each of the above devices,
Based on the set attack probability variables and impact variables, the security threat risk for each of the above devices is calculated,
Includes a processor that generates a visualization model that visualizes the generated security threat risk level,
The above processor,
From a database storing a large number of security threat data accumulated for devices in a smart factory, identify the security threat data that is identical to or most similar to the generated security threat data,
From the above database, information on the impact variables corresponding to the identified security threat data is obtained, and the obtained impact variables are set as the impact variables of the generated security threat data.
device.
In Article 9,
The above devices are included in multiple layers that constitute the smart factory,
The above processor,
Create a visualization model that visualizes the security threat risk level for each device included in multiple layers that constitute the above smart factory.
device.
In Article 9,
The above processor,
From the heat map color distribution information according to the security threat risk level, a heat map color is set for each of the above devices,
Generate the above visualization model by reflecting the set heatmap colors.
device.
In Article 9,
The above processor,
Analyze the level of security vulnerabilities in the devices and software included in the above smart factory,
Determine the vulnerability severity corresponding to the analysis results,
Based on the assessed vulnerability severity, an attack probability variable is set for each device included in the smart factory.
device.
In Article 12,
The above vulnerability severity corresponds to the CVSS score calculated by the common vulnerability scoring system (CVSS).
The above attack probability variable is set to the value of the vulnerability grade corresponding to the calculated CVSS score among multiple vulnerability grades classified by CVSS score interval.
device.
In Article 9,
The above communication unit receives the data including at least one of a log and a security event generated from the smart factory,
The above processor,
The above received data is analyzed through a SIEM solution,
Generate security threat data indicating security threats to each of the above devices based on the analysis results.
device.
delete In Article 9,
Further comprising an output section for outputting the generated visualization model,
device.