Security Protection Strategy Evaluation Method of Power Monitoring System Based on ATT&CK Framework

In order to evaluate the ability of power monitoring system to resist network attacks under the new security situation, this paper proposes a security protection strategy evaluation method based on ATT&CK framework. This method takes attack technology as the basic element of evaluation, and refers to the risk calculation method of FMECA. Firstly, the impact caused by the attack, the probability of atomic attack and the effectiveness of protective measures are determined by using the centrality of point degree, CVSS evaluation method and pain pyramid model. Then, a set of risk calculation model was established, which combined the ATT&CK framework with the network killing chain, and used the methods of barrel theory, Bayesian network and eigenvector centrality to calculate the overall risk value of the system. Finally, the risk value was used to deduce the security protection strategy evaluation conclusion. In this method, the security protection method is substituted into the risk calculation as a risk factor, the system risk value is associated with its security protection strategy, and the protection level of the security protection strategy is scientifically evaluated.