CN111695115A - Industrial control system network attack tracing method based on communication delay and security evaluation - Google Patents

Abstract

The invention discloses a network attack source tracing method for industrial control systems based on communication delay and security assessment, comprising: S1, determining a potential attack source address list L; S2, sending a network state feedback request to all nodes in L, if there is a node If the network connection is disconnected, or no feedback is received after the preset number of requests, it is judged as an attack source, otherwise, go to S3; S3, send a system operating status information feedback request to all nodes in L; S4, conduct security according to the system operating status information S5, send a system supervision log information feedback request to all nodes in L; S6, carry out security evaluation according to the system supervision log information, and use the node with the lowest safety degree as the attack source ; S7, output the switch information or router information list directly connected to the node in L, which is used for illegal external terminal investigation. The method achieves comprehensive coverage of potential attack sources and accurate location of attack sources.

Description

A method for tracing the source of industrial control system network attack based on communication delay and security assessment

technical field

The invention belongs to the technical field of smart grid security, and in particular relates to a method for tracing the source of an industrial control system network attack based on communication delay and security assessment.

Background technique

Network attack source tracing can help the power industrial control system to adopt appropriate defense strategies, block the attack from the source, and free the power industrial control system from the threat of attack to the greatest extent. At present, there is a lack of related research on the source tracing of industrial control system network attacks based on communication delay and security assessment. Because the real-time control business in the power industrial control system has high real-time requirements and some communication protocols have no TCP/IP layer, the network attack source tracing method for traditional information networks cannot be applied.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a method for tracing the source of an industrial control system network attack based on communication delay and security assessment, so as to solve the problem of how to effectively trace the network attack of an electric power industrial control system to determine the source of the attack.

The technical scheme adopted by the present invention to solve its technical problems is:

A method for tracing the source of an industrial control system network attack based on communication delay and security assessment, comprising the following steps:

S1. Determine all potential attack sources, and determine a potential attack source address list L according to all potential attack sources. The potential attack sources include attack packets, all packets with the same delay characteristics as the attack packets, and capture attacks. The terminal directly connected to the transmission equipment of the message;

S2. Send a network status feedback request to all nodes in L. If the network connection of any node is disconnected, or no feedback is received after a preset number of requests, it is judged as an attack source, otherwise, go to S3;

S3. Send a system operating state information feedback request to all nodes in L;

S4. Perform a security assessment according to the system operating state information to obtain a first-level security list. If there is a node with a security level lower than the first preset threshold, the node with the lowest security level is used as the attack source, otherwise, go to S5;

S5. Send a system supervision log information feedback request to all nodes in L;

S6. Perform a security assessment according to the system supervision log information, and obtain a list of secondary security degrees. If there is a terminal node whose security degree is lower than the second preset threshold, the node with the lowest security degree is used as the attack source, otherwise, go to S7 ;

S7. Output the switch information or router information list directly connected to the node in L, which is used for the investigation of illegal external terminals.

Further, the step S1 includes:

S1.1. Initialize the address list L of potential attack sources; when the attack packet is a non-Ethernet frame, go to S1.3; when the attack packet is an Ethernet frame without an IP header, the The source MAC address is added to L; when the packet is an Ethernet frame and has an IP header, the device MAC address corresponding to the source IP address is added to L;

S1.2. Obtain the MAC addresses of all non-transmission devices directly connected to the capture point, and add L;

S1.3. Obtain the time label of the attack packet, and calculate the delay information of the attack packet. If there is no time label, go to S1.5

S1.4. According to the delay information, obtain the MAC addresses of all nodes with the same delay characteristic as the second attack source address list. If the second attack source address list is not empty, add L, and end S1; 2. If the attack source address list is empty, go to S1.5;

S1.5. Update L to a list of MAC addresses of all terminals in the same network as the attack capture point.

Further, the system running state information includes any one or more of: CPU utilization, memory utilization, swap partition utilization, disk utilization and number of processes.

Further, the system supervision log information includes: file addition, deletion and modification records and/or process detailed information.

The beneficial effects of the present invention are:

The packet with the same delay characteristic as the attack packet and the terminal directly connected to the transmission device that captures the attack packet are used as potential attack sources, thus realizing comprehensive coverage of potential attack sources and avoiding omissions. According to the network connection status feedback, the system running status information feedback and the system monitoring log information feedback, the attack source can be traced back to the level by level, which can realize the accurate location of the attack source.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings and embodiments, in which:

1 is a flowchart of a method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by an embodiment of the present invention;

2 is an application scenario diagram of a method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by an embodiment of the present invention;

3 is a flowchart of a method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by another embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present invention.

FIG. 1 is a flowchart of a method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by an embodiment of the present invention. As shown in FIG. 1 , an embodiment of the present invention provides an industrial control system based on communication delay and security assessment. The system network attack source tracing method includes the following steps:

S1. Determine all potential attack sources, and determine a potential attack source address list L according to all potential attack sources. The potential attack sources include attack packets, all packets with the same delay characteristics as the attack packets, and capture attacks. The terminal directly connected to the packet transmission device.

2 is an application scenario diagram of the method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by an embodiment of the present invention, as shown in FIG. First, the attacker implants malicious code on the operator's device. After that, when the operation and maintenance personnel connect the device to the substation station control layer network for operation and maintenance, the device is used as a "springboard" to implant malicious code into a terminal by using the loopholes in the power grid embedded terminal, that is, the measurement and control terminal; the The malicious code can tamper with the data field of the GOOSE control message transmitted on the network to realize the circuit breaker operation controlled by other terminals in the same VLAN as the terminal; finally, the malicious program can continuously tamper with the control message to achieve multiple Each circuit breaker is turned on/off at the same time for many times, so as to achieve the purpose of causing continuous damage to the power grid.

An intrusion detection system ("IDS" for short) is a network security device that monitors network transmissions in real time, and issues an alarm or takes proactive measures when suspicious transmissions are found. After the IDS detects attack packets, it provides network attack-related information to determine potential attack sources. In this embodiment, a server may be set, or an existing server may be used as a network attack source tracing host to execute the method. Considering the delay characteristics of attack packets, in this embodiment, packets with the same delay characteristics are also considered as potential attack sources. The same delay feature can be determined according to a preset interval, for example, (0, 0.2ms] is an interval, and the interval is regarded as the same feature. At the same time, it is also necessary to consider the terminal directly connected to the transmission device that captures the attack packet. For example, the final attack source address list L is determined according to the source MAC addresses and destination MAC addresses of these potential attack sources.

S2. Send a network status feedback request to all nodes in L. If the network connection of any node is disconnected, or no feedback is received after a preset number of requests, it is determined as an attack source, otherwise, go to S3.

All suspicious nodes in the notification list L feed back the current network connection status to the network attack source tracing host. If the network attack source tracing host has not received the network connection status of a suspicious node within t _MAX time, it will re-send the notification command to the node to predict After setting the number of times (such as three times) and still not received, it is determined that the location of the suspicious node is the location of the attack source. At this time, the attacking device is an illegal terminal. According to the preset network topology map, output the MAC of the transmission device accessed by the node. The address and port number are used as the location of the attack source, and the network attack source tracing ends. If a suspicious node is disconnected from the network where the attack capture point provided by the IDS is located, it is determined that the location of the suspicious node is the source of the attack. At this time, the attacking device is an illegal terminal, and the MAC of the transmission device accessed by the node is output. The address and port number are used as the location of the attack source, and the network attack source tracing ends. If the network attack source tracing host receives the network connection status of all suspicious nodes, and the network connection status of all suspicious nodes is normal, go to S3.

S3. Send a system operating state information feedback request to all nodes in L.

All suspicious nodes in the notification list L feed back system operating status information to the network attack source tracing host.

As an optional embodiment, the system running state information includes any one or more of: CPU utilization, memory utilization, swap partition utilization, disk utilization, and number of processes.

For example, the system running status information also includes: CPU utilization, memory utilization, swap partition utilization, disk utilization and number of processes.

S4. Perform a security assessment according to the system operating state information to obtain a first-level security list. If there is a node with a security level lower than the first preset threshold, the node with the lowest security level is used as an attack source, otherwise, go to S5.

The network attack source tracing host performs a first-level security evaluation on the system operating status information of all suspicious nodes. The evaluation is implemented based on the existing methods. The evaluation algorithm can use a support vector machine to obtain the first-level security list L _x1 to determine whether there is a first-level security. For nodes whose degree is lower than the threshold X ₁ (the first preset threshold), X ₁ is 0.3 by default. If it exists, the node with the lowest security degree is used as the attack source. At this time, the attacking device is a legitimate terminal and outputs the MAC address of the node. address, and according to the preset network topology map, output the MAC address and port number of the transmission device connected to the node as the location of the attack source, and the network attack source tracing ends. If it does not exist, go to S5.

S5. Send a system supervision log information feedback request to all nodes in L.

All suspicious nodes in the notification list L feed back the current system supervision log information to the network attack source tracing host.

As an optional embodiment, the system supervision log information includes: file addition, deletion and modification records and/or process detailed information. the above embodiment. For example, also include: important file CRUD records and process details.

S6. Perform a security assessment according to the system supervision log information, and obtain a second-level security degree list L _x2 . If there is a terminal node whose security degree is lower than the second preset threshold, the node with the lowest security degree is used as the attack source; otherwise, transfer to to S7.

The network attack source tracing host performs a secondary security assessment on the supervision log information of all suspicious nodes. The evaluation algorithm can use a support vector machine to obtain a secondary security list L _x2 , and determine whether there is a node whose secondary security is lower than the threshold X ₂ , X ₂ is 0.5 by default. If it exists, the node with the lowest security degree is the attack source. At this time, the attacking device is a legitimate terminal, output the MAC address of the node, and according to the preset network topology map, output the access point of the node. The MAC address and port number of the transmission device are used as the location of the attack source, and the network attack source tracing ends. If it does not exist, go to S7. At this time, the attacking device is an illegal terminal.

S7. Output the switch information or router information list directly connected to the node in L, which is used for the investigation of illegal external terminals.

Based on the address list L of potential attack sources and the preset network topology, output the list of switch information or router information directly connected to these nodes in the list L _DTE , and notify the administrator to check whether there are external illegal terminals on these switches or routers. The source tracing of cyber attacks is over.

The method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by the embodiment of the present invention includes a packet with the same delay characteristic as an attack packet and a terminal directly connected to a transmission device that captures the attack packet, As a potential attack source, the comprehensive coverage of the potential attack source is realized to avoid omission. According to the network connection status feedback, the system running status information feedback and the system monitoring log information feedback, the attack source can be traced back to the level by level, which can realize the accurate location of the attack source.

Based on the foregoing embodiment, as an optional embodiment, FIG. 3 is a flowchart of a method for tracing the source of an industrial control system network attack based on communication delay and security assessment provided by another embodiment of the present invention. As shown in FIG. 3 , except for step S1 Basically the same as the above-mentioned embodiment, the above-mentioned step S1 includes:

S1.1. Initialize the address list L of potential attack sources; when the attack packet is a non-Ethernet frame, go to S1.3; when the attack packet is an Ethernet frame without an IP header, the The source MAC address is added to L; when the packet is an Ethernet frame with an IP header, the device MAC address corresponding to the source IP address is added to L.

Initialize the potential attack source address list L={MAC _source }. If the attack packet is a non-Ethernet frame, set the MAC _source to be empty, and go to S1.3. If the packet is an Ethernet frame but does not have an IP header, determine whether the source MAC address in the attack packet is a broadcast MAC. If so, set the MAC _source to null; otherwise, the MAC _source is the source MAC address in the attack packet. address; if the packet is an Ethernet frame and has an IP header, read the source IP address in the IP header of the packet, if the IP address is a broadcast address, set the MAC _source to null, otherwise, according to the preset network The topology map obtains the device MAC address corresponding to the IP, and the device MAC address is the MAC _source .

S1.2: Acquire the MAC addresses of all non-transmission devices directly connected to the capture point, and add L.

According to the MAC address MAC _capture of the attack capture point provided by the intrusion detection system, obtain the MAC addresses of all non-transmission devices directly connected to the transmission device whose MAC address is MAC _capture from the preset network topology map, and add all MAC addresses to into the list L of possible attack sources. The transmission device refers to the device that implements the message forwarding function on the communication network, and the non-transmission device refers to the device that communicates on the communication network, that is, the data terminal device.

S1.3. Obtain the time label of the attack packet, and calculate the delay information of the attack packet. If there is no time label, go to S1.4.

Read the UTC time tag t _UTC and the message length length carried in the attack packet. If the time tag field does not exist in the attack packet, go to S1.5; otherwise, according to the time t provided by the IDS to capture the packet The precisions of _current , t _UTC and t _current are all milliseconds, and the calculated delay information is t _delay =t _current -t _UTC .

S1.4. According to the delay information, obtain the MAC addresses of all nodes with the same delay characteristic as the second attack source address list. If the second attack source address list is not empty, add L, and end S1; 2. If the attack source address list is empty, go to S1.5.

Input length, MAC _capture , t _UTC and t _Delay into the communication delay model, and obtain the MAC address list L _delay of all nodes that meet the delay characteristics. The communication delay model can be pre-built according to the mapping relationship between the communication delay range (or delay characteristics) and the node MAC address. For the power industrial control system, when no fault occurs, the communication delay of the same device is relatively stable at the same time every day (because most services are periodic), so that the sent message can be obtained according to the delay of the attack message. The nodes with the same delay characteristics are regarded as potential attack nodes, and the MAC addresses of these nodes are regarded as the second attack source address list. The present invention takes the error of the delay value into consideration, and uses the delay range instead of the determined delay value as the mapping of different MAC addresses, which can improve the robustness of the present invention. If L _delay is not empty, add all the MAC addresses in the list L _delay into L, that is, L={L, L _delay }, end S1, and go to S2; otherwise, go to S1.5.

S1.5. Update L to a list of MAC addresses of all terminals in the same network as the attack capture point.

According to the preset network topology, L is updated to a list consisting of the MAC addresses of all terminals located in the same network as the attack capture point provided by the IDS. Because some networks of the power industrial control system are physically isolated, terminals in different physically isolated networks cannot communicate. When two terminals can communicate without being physically separated, the two terminals are considered to be in the same network.

Based on the above-mentioned embodiments, a specific example is described as follows:

Obtain relevant information about network attacks from the intrusion detection system, including: the attack packet PG ₃ , the MAC address MAC ₁ of the capture point of the attack packet, and the packet capture time UTC _cap1 ;

After calculation, the communication delay of the attack packet is 0.1225ms. Considering that the delay accuracy is only milliseconds in the actual situation, the delay is recorded as 0ms;

Obtain a list of all possible attack sources using a statistics-based communication delay model L _attack = {MAC ₂₄ ,MAC ₂₆ ,MAC ₂₈ ,MAC ₃₀ ,MAC ₃₂ ,MAC ₃₄ ,MAC ₃₅ ,MAC ₃₆ ,MAC ₃₇ ,MAC ₃₈ };

Obtain the current network connection status of all terminals in L _attack . After judgment, the network connection status of these terminals is normal;

Obtain the system running status information of all terminals in L _attack , including: CPU utilization, memory utilization, swap partition utilization, disk utilization and number of processes;

The first-level security evaluation is performed on the system operating status information of all terminals in L _attack , and the first-level security list L _x1 = {0.7881, 0.7683, 0.8233, 0.7374, 0.8411, 0.0055, 0.7833, 0.4543, 0.7946, 0.6914} is obtained. It is judged that there is a terminal whose first-level security degree is lower than the threshold X ₁ (X ₁ takes the default value of 0.3), and the terminal with the lowest security degree is the attack source. At this time, the attacking device is a legitimate terminal, and the MAC address of the terminal is output MAC ₃₄ , and according to the preset network topology map, output the transmission equipment MAC address MAC ₁₈ and port number 2 accessed by the terminal as the network coordinates of the attack source, and the network attack source tracing ends.

The present invention has been described with reference to a few embodiments. However, as is known to those skilled in the art, other embodiments than the above disclosed invention are equally within the scope of the invention, as defined by the appended patent claims.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Modifications or equivalent replacements are made to the specific embodiments of the present invention, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (4)

1. an industrial control system network attack source tracing method based on communication time delay and security assessment, is characterized in that, comprises the following steps: S1. Determine all potential attack sources, and determine a potential attack source address list L according to all potential attack sources. The potential attack sources include attack packets, all packets with the same delay characteristics as the attack packets, and capture attacks. The terminal directly connected to the transmission equipment of the message; S2. Send a network status feedback request to all nodes in L. If the network connection of any node is disconnected, or no feedback is received after a preset number of requests, it is judged as an attack source, otherwise, go to S3; S3. Send a system operating state information feedback request to all nodes in L; S4. Perform a security assessment according to the system operating state information to obtain a first-level security list. If there is a node with a security level lower than the first preset threshold, the node with the lowest security level is used as the attack source, otherwise, go to S5; S5. Send a system supervision log information feedback request to all nodes in L; S6. Perform a security assessment according to the system supervision log information, and obtain a list of secondary security degrees. If there is a terminal node whose security degree is lower than the second preset threshold, the node with the lowest security degree is used as the attack source, otherwise, go to S7 ; S7. Output the switch information or router information list directly connected to the node in L, which is used for the investigation of illegal external terminals. 2. The method for tracing the source of an industrial control system network attack based on communication delay and security assessment according to claim 1, wherein the step S1 comprises: S1.1. Initialize the address list L of potential attack sources; when the attack packet is a non-Ethernet frame, go to S1.3; when the attack packet is an Ethernet frame without an IP header, the The source MAC address is added to L; when the packet is an Ethernet frame and has an IP header, the device MAC address corresponding to the source IP address is added to L; S1.2. Obtain the MAC addresses of all non-transmission devices directly connected to the capture point, and add L; S1.3. Obtain the time label of the attack packet, and calculate the delay information of the attack packet. If there is no time label, go to S1.5 S1.4. According to the delay information, obtain the MAC addresses of all nodes with the same delay characteristic as the second attack source address list. If the second attack source address list is not empty, add L, and end S1; 2. If the attack source address list is empty, go to S1.5; S1.5. Update L to a list of MAC addresses of all terminals in the same network as the attack capture point. 3. The method for tracing the source of an industrial control system network attack based on communication delay and security assessment according to claim 1, wherein the system operating state information comprises: CPU utilization, memory utilization, swap partition utilization, Any one or more of disk utilization and number of processes. 4. the industrial control system network attack source tracing method based on communication delay and security assessment according to claim 1, is characterized in that, described system supervision log information comprises: file addition, deletion and modification record and/or process detailed information.

Images