To solve the low attack path quantification degree and complex path finding in the industrial Internet of Things, a vulnerability assessment method based on attack graph and maximum flow is proposed. The method takes into account the factors influencing the attack behavior and relationship between network nodes. The attack risk is calculated by common vulnerability scoring system, which increases the attack path quantification degree. The maximum loss flow describes the attack path, evaluates the network vulnerability by maximum loss flow and loss saturation and represents the vulnerability relevance. Avoiding the repeat calculation and obtaining the potential key vulnerability path fast, the augmented road algorithm is used to find optimal attack path within global path. The result shows that the method is feasible and can evaluate the vulnerability and risk path objectively.

Network attack identification effectively secures Internet of Things (IoT) application scenarios. However, dynamic scene changes, attack feature reliance, high data dimensions, and challenges with spatio-temporal feature fusion frequently pose limitations to attack traffic identification in IoT contexts. Definitive intelligent IoT attack identification enables intelligent algorithms to extract attack features for application scenarios with fixed topological environments but cannot construct the intricate changes of IoT application scenarios. Through the dynamic acquisition, feature awareness, and deep learning, intelligent digital twin-based attack detection can address these issues and enhance attack identification for IoT threats. Thus, this paper proposed an intelligent digital twin method based on spatio-temporal feature fusion for IoT attack behavior identification. Firstly, feature subsets are selected based on information gain to reduce the dimensionality of IoT data with high traffic; Secondly, a parallel spatio-temporal feature extraction model is designed unlike the existing tandem model, which uses a simplified Convolutional Neural Networks (CNN) model to learn the spatial features of the attack, a Bi-directional Long Short-Term Memory (BiLSTM) model to learn the temporal features of the attack, an attention mechanism to fuse the temporal and spatial features, and the (Deep Neural Networks) DNN to learn the combined features; Finally, the virtual instance space and topology of the attack scenario are simulated using digital twin (DT) to build a digital version of the complex system for IoT applications and tested in a simulation environment. Based on experimental results using the UNSW-NB15 and CICIDS2017 datasets, this paper shows that the proposed method can extract spatio-temporal features from network attack traffic and has a 5% improvement in test accuracy.

Enhancing the security capability of decentralized networks has been a focus of attention in the IoT academic community. Decentralized networks face problems, such as lack of security resources, complex and heterogeneous difficulties in network security management, and dependence on the level of knowledge of human experts for security defense strategies and management effects. To tackle these challenges, this study presents a multiagent deep reinforcement learning autonomous security management approach. The research builds a finite random game network attack–defense model that captures the dynamic adversarial nature of the attack–defense process. Leveraging reinforcement learning techniques, autonomous defense agent is designed to autonomously generate and adapt defense strategies. To enhance the defense capability, a network attack agent is developed. Moreover, drawing inspiration from MINIMAX $Q$ -learning, a synchronized interactive training mechanism is discussed to address the issue of environment instability arising from the decoupling of observation space and action space among multiple coexisting offensive and defensive agents in the same environment. Experimental simulations validate the effectiveness of the proposed method in automated attack–defense scenarios and analyze the generalization ability in networks of different scales.