| |
| 文章导读 |
|
摘要将攻击图技术应用于工业控制系统 (ICS), 并基于工业控制系统网络结构特点,简化了攻击图的生成复杂度。该文将工业控制系统作为研究对象,下位机作为攻击目标,依据工业控制系统的层次化结构特点,提出了主机安全域和网络安全域的概念,对系统网络进行安全域划分实现攻击图的分布式生成,并依据划分结果使用攻击模式(remote/local)等要素来降低攻击图的生成复杂度。最后,通过搭建实验测试环境进行验证,实验结果表明本方法将会提高攻击图生成效率并简化攻击图规模。
|
| 关键词 ：工业控制系统(ICS),攻击图,安全域,风险评估 |
Abstract：An attack graph technique is given for industrial control systems (ICS) that simplifies the complexity of the attack graph generation based on the characteristics of the control system network structure. The characteristics of the control system's hierarchical structure were analyzed to develop a host security domain and a network security domain. The network is divided into some security domains so that the attack patterns (remote/local) and other factors can be separated to reduce the complexity of the attack graph generation. Consequently, this method improves the production efficiency and simplifies the attack graph scale. The method is tested in a virtual network environment.
|
| Key words：industrial control systems (ICS)attack graphsecurity domainrisk assessment |
| 收稿日期: 2013-12-01 出版日期: 2015-04-16 |
|
| 基金资助: |
| [1] | 彭勇, 江常青, 谢丰, 等. 工业控制系统信息安全研究进展 [J]. 清华大学学报: 自然科学版, 2012, 52(10): 1396-1408. PENG Yong, JIANG Changqing, XIE Feng, et al.Industrial control system cyber security research[J]. Journal of Tsinghua University: Science and Technology, 2012, 52(10): 1396-1408. (in chinese). |
| [2] | Ammann P, Wijesekera D, KaushikS. Scalable, graph-based network vulnerability analysis [C] //Proceedings of the 9th ACM Conference on Computer and Communications Security. New York, USA: Association for Computing Machinery Press, 2002. 217-224. |
| [3] | 胡欣, 孙永林, 王勇军. 一种基于网络安全梯度的攻击图生成并行化方法[J]. 计算机应用与软件, 2011, 28(11): 25-29. HU Xin, SUN Yonglin, WANG Yongjun. A network security grade based attack graph generation parallel approach[J]. Computer Applications and Software, 2011, 28(11): 25-29. |
| [4] | Swiler L P, Phillips C, Ellis D, et al.Computer-attack graph generation tool [C] //Proceedings of DARPA Information Survivability Conference and Exposition. Anaheim, USA: IEEE Computer Society, 2001: 1307-1321. |
| [5] | Swiler L P, Phillips C, Gaylor T. A graph-based network-vulnerability analysis system, SAND97-3010/1 [R]. Albuquerque, USA: Sandia National Laboratories, 1998. |
| [6] | NIST SP800-82. Guide to Industrial Control Systems (ICS) Security[S]. Gaithersburg, USA: National Institute of Standards and Technology (NIST), 2011. |
| [7] | Ritchey R W, Ammann P. Using model checking to analyze network vulnerabilities [C]// Proceedings of 2000 IEEE Computer Society Symposium on Security and Privacy. Oakland, USA: IEEE Computer Society, 2000: 156-165. |
| [8] | OU Xinming. A Logic-programming Approach to Network Security Analysis[M]. Princeton, USA: Princeton University, 2005. |
| [9] | Ralston P A S, Graham J H, Hieb J L. Cyber security risk assessment for SCADA and DCS networks[J]. ISA Transactions, 2007, 46(4): 583-594. |
| [10] | Byres E J, Franz M, Miller D. The use of attack trees in assessing vulnerabilities in SCADA systems [C]// International Infrastructure Survivability Workshop (IISW'04). Lisbon, Portugal: IEEE, 2004. |
| [11] | Cheminod M, Bertolotti I C, Durante L, et al.Detecting chains of vulnerabilities in industrial networks[J]. Industrial Informatics, IEEE Transactions on, 2009, 5(2): 181-193. |
| [12] | Stouffer K, Falco J, Scarfone K. Guide to Industrial Control Systems (ICS) Security, NIST—National Institute of Standard and Technology, 2008, Final Public Draft [Z/OL]. (2013-08-20), http://csrc.nist.gov/publications/drafts/800- 82/draft_sp800-82-fpd.pdf. |
| [13] | Ten C W, Liu C C, Govindarasu M. Vulnerability assessment of cybersecurity for SCADA systems[J] IEEE Transactions on Power Sytems, 2008, 23(4): 1836-1846. |
| [14] | David A. Multiple Efforts to Secure Control Systems Are under Way, But Challenges Remain, GAO-07-1036 [R]. Washington DC, USA: US Government Accountability Office (US GAO), 2007. |
| [15] | NIST SP800-82. Guide to Industrial Control Systems (ICS) Security[S]. Maryland, USA: National Institute of Standard and Technology (NIST), 2003. |
),江常青2,彭勇2
