Key path analysis method for large-scale industrial control network

Yaofang ZHANG; Zheyu ZHANG; Haikuo QU; Ge ZHANG; Zibo WANG; Bailing WANG

doi:10.11959/j.issn.2096-109x.2021069

您当前的位置：

首页 >

文章列表页 >

Key path analysis method for large-scale industrial control network

TopicⅠ: Novel Network Technology and Security | 更新时间：2024-06-03

- Key path analysis method for large-scale industrial control network
- Chinese Journal of Network and Information Security Vol. 7, Issue 6, Pages: 31-43(2021)
- 作者机构：
  
  1. 哈尔滨工业大学（威海）计算机科学与技术学院，山东威海264209
  2. 国家工业信息安全发展研究中心，北京 100040
  3. 哈尔滨工业大学网络空间安全研究院，黑龙江哈尔滨 150006
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021069
  CLC： TP393
- Online First：2021-12，
  
  Published：15 December 2021
- 稿件说明：
移动端阅览
Yaofang ZHANG, Zheyu ZHANG, Haikuo QU, et al. Key path analysis method for large-scale industrial control network[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 31-43.
DOI：

Yaofang ZHANG, Zheyu ZHANG, Haikuo QU, et al. Key path analysis method for large-scale industrial control network[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 31-43. DOI： 10.11959/j.issn.2096-109x.2021069.

摘要

针对大规模工控网络攻击图的量化计算耗时高、消耗资源大的问题，提出了一种大规模工控网络的关键路径分析方法。首先利用割集思想结合工控网络中的原子攻击收益，计算贝叶斯攻击图关键节点集合，解决目前割集算法只考虑图结构中节点关键性的问题。其次，提出一种只更新关键节点攻击概率的贝叶斯攻击图动态更新策略，高效计算全图攻击概率，分析攻击图关键路径。实验结果表明，所提方法在大规模工控攻击图的计算中，不仅可以保证计算结果的可靠性，而且能够大幅度降低方法耗时，显著提升计算效率。

Abstract

In order to solve the problem of high time-consuming and resource-consuming quantitative calculation of large-scale industrial control network attack graphs

a key path analysis method for large-scale industrial control networks was proposed.Firstly

the idea of cut set was used to calculate the key nodes set of Bayesian attack graph by combining the atomic attack income in industrial control network

which solved the problem that the current cut set algorithm only considers the key nodes in graph structure.Secondly

a dynamic updating strategy of Bayesian attack graph which only updated the attack probability of key nodes was proposed to efficiently calculate the attack probability of the whole graph and analyze the key path of attack graph.The experimental results show that the proposed method can not only ensure the reliability of the calculation results of large-scale industrial control attack graphs

but also can significantly reduce the time consumption and have a significant improvement in the calculation efficiency.

关键词

Keywords

references

NOURIAN A , MADNICK S . A systems theoretic approach to the security threats in cyber physical systems applied to Stuxnet [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 15 ( 1 ): 2 - 13 .

LIANG G Q , WELLER S R , ZHAO J H , et al . The 2015 Ukraine blackout:implications for false data injection attacks [J ] . IEEE Transactions on Power Systems , 2017 , 32 ( 4 ): 3317 - 3318 .

AKBANOV M , VASSILAKIS V G , LOGOTHETIS M D . Ransomware detection and mitigation using software-defined networking:the case of WannaCry [J ] . Computers ＆ Electrical Engineering , 2019 , 76 : 111 - 121 .

ALLADI T , CHAMOLA V , ZEADALLY S . Industrial control systems:cyberattack trends and countermeasures [J ] . Computer Communications , 2020 , 155 : 1 - 8 .

吴晨思 , 谢卫强 , 姬逸潇 , 等 . 网络系统安全度量综述 [J ] . 通信学报 , 2019 , 40 ( 6 ): 14 - 31 .

WU C S , XIE W Q , JI Y X , et al . Survey on network system secu-rity metrics [J ] . Journal on Communications , 2019 , 40 ( 6 ): 14 - 31 .

PHILLIPS C , SWILER L P . A graph-based system for network-vulnerability analysis [C ] // Proceedings of the 1998 Workshop on New Security Paradigms - NSPW '98 . 1998 : 71 - 79 .

叶子维 , 郭渊博 , 王宸东 , 等 . 攻击图技术应用研究综述 [J ] . 通信学报 , 2017 , 38 ( 11 ): 121 - 132 .

YE Z W , GUO Y B , WANG C D , et al . Survey on application of at-tack graph technology [J ] . Journal on Communications , 2017 , 38 ( 11 ): 121 - 132 .

POOLSAPPASIT N , DEWRI R , RAY I . Dynamic security risk management using Bayesian attack graphs [J ] . IEEE Transactions on Dependable and Secure Computing , 2012 , 9 ( 1 ): 61 - 74 .

MUÑOZ-GONZÁLEZ L , SGANDURRA D , BARRÈRE M , , et al . Exact inference techniques for the analysis of Bayesian attack graphs [J ] . IEEE Transactions on Dependable and Secure Computing , 2017 , 16 ( 2 ): 231 - 244 .

杨英杰 , 冷强 , 常德显 , 等 . 基于属性攻击图的网络动态威胁分析技术研究 [J ] . 电子与信息学报 , 2019 , 41 ( 8 ): 1838 - 1846 .

YANG Y J , LENG Q , CHANG D X , et al . Research on network dynamic threat analysis technology based on attribute attack graph [J ] . Journal of Electronics ＆ Information Technology , 2019 , 41 ( 8 ): 1838 - 1846 .

王辉 , 王云峰 , 王坤福 . 基于贝叶斯推理的攻击路径预测研究 [J ] . 计算机应用研究 , 2015 , 32 ( 1 ): 226 - 231 .

WANG H , WANG Y F , WANG K F . Research on predicting attack path based on Bayesian inference [J ] . Application Research of Computers , 2015 , 32 ( 1 ): 226 - 231 .

张少俊 , 李建华 , 宋珊珊 , 等 . 贝叶斯推理在攻击图节点置信度计算中的应用 [J ] . 软件学报 , 2010 , 21 ( 9 ): 2376 - 2386 .

ZHANG S J , LI J H , SONG S S , et al . Using Bayesian inference for computing attack graph node beliefs [J ] . Journal of Software , 2010 , 21 ( 9 ): 2376 - 2386 .

陈小军 , 方滨兴 , 谭庆丰 , 等 . 基于概率攻击图的内部攻击意图推断算法研究 [J ] . 计算机学报 , 2014 , 37 ( 1 ): 62 - 72 .

CHEN X J , FANG B X , TAN Q F , et al . Inferring attack intent of malicious insider based on probabilistic attack graph model [J ] . Chinese Journal of Computers , 2014 , 37 ( 1 ): 62 - 72 .

黄家辉 , 冯冬芹 , 王虹鉴 . 基于攻击图的工控系统脆弱性量化方法 [J ] . 自动化学报 , 2016 , 42 ( 5 ): 792 - 798 .

HUANG J H , FENG D Q , WANG H J . A method for quantifying vulnerability of industrial control system based on attack graph [J ] . Acta Automatica Sinica , 2016 , 42 ( 5 ): 792 - 798 .

罗智勇 , 杨旭 , 刘嘉辉 , 等 . 基于贝叶斯攻击图的网络入侵意图分析模型 [J ] . 通信学报 , 2020 , 41 ( 9 ): 160 - 169 .

LUO Z Y , YANG X , LIU J H , et al . Network intrusion intention analysis model based on Bayesian attack graph [J ] . Journal on Communications , 2020 , 41 ( 9 ): 160 - 169 .

马春光 , 汪诚弘 , 张东红 , 等 . 一种基于攻击意愿分析的网络风险动态评估模型 [J ] . 计算机研究与发展 , 2015 , 52 ( 9 ): 2056 - 2068 .

MA C G , WANG C H , ZHANG D H , et al . A dynamic network risk assessment model based on attacker's inclination [J ] . Journal of Computer Research and Development , 2015 , 52 ( 9 ): 2056 - 2068 .

高梦州 , 冯冬芹 , 凌从礼 , 等 . 基于攻击图的工业控制系统脆弱性分析 [J ] . 浙江大学学报(工学版) , 2014 , 48 ( 12 ): 2123 - 2131 .

GAO M Z , FENG D Q , LING C L , et al . Vulnerability analysis of industrial control system based on attack graph [J ] . Journal of Zhe-jiang University (Engineering Science) , 2014 , 48 ( 12 ): 2123 - 2131 .

叶云 , 徐锡山 , 齐治昌 . 大规模网络中攻击图的节点概率计算方法 [J ] . 计算机应用与软件 , 2011 , 28 ( 11 ): 136 - 139 , 192 .

YE Y , XU X S , QI Z C . Attack graph's nodes probabilistic compu-ting approach in a large-scale network [J ] . Computer Applications and Software , 2011 , 28 ( 11 ): 136 - 139 , 192 .

刘贞宇 , 陈羽中 , 郭昆 , 等 . 面向网络攻击建模的分布式过程挖掘与图分割方法 [J ] . 小型微型计算机系统 , 2020 , 41 ( 8 ): 1732 - 1740 .

LIU Z Y , CHEN Y Z , GUO K , et al . Distributed process mining and graph segmentation for network attack modeling [J ] . Journal of Chinese Computer Systems , 2020 , 41 ( 8 ): 1732 - 1740 .

吴金宇 , 金舒原 , 杨智 . 基于网络流的攻击图分析方法 [J ] . 计算机研究与发展 , 2011 , 48 ( 8 ): 1497 - 1505 .

WU J Y , JIN S Y , YANG Z . Analysis of attack graphs based on network flow method [J ] . Journal of Computer Research and De-velopment , 2011 , 48 ( 8 ): 1497 - 1505 .

彭武 , 胡昌振 , 姚淑萍 . 基于攻击路径图的入侵意图识别 [J ] . 北京理工大学学报 , 2010 , 30 ( 9 ): 1077 - 1081 .

PENG W , HU C Z , YAO S P . Intrusive intention recognition based on attack path graph [J ] . Transactions of Beijing Institute of Tech-nology , 2010 , 30 ( 9 ): 1077 - 1081 .

Common vulnerability scoring system version 2.0 [EB ] .

CHEMINOD M , DURANTE L , SENO L , et al . Detection of attacks based on known vulnerabilities in industrial networked systems [J ] . Journal of Information Security and Applications , 2017 , 34 : 153 - 165 .

CHE Y B , ZHAO Y C , XU J M , et al . A hierarchical approach for fast calculating minimal cut sets of a microgrid [J ] . Mathematical Problems in Engineering , 2017 , 2017 : 1 - 8 .

Views

210

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-query based key node mining algorithm for social networks

Autonomous security analysis and penetration testing model based on attack graph and deep Q-learning network

Research on network risk assessment based on attack graph of expected benefits-rate

Survey of attack graph based network security metric

Related Author

Wei WANG

Runxuan Liu

Jiayang Wei

Junheng HUANG

Tengwei ZHU

Guodong XIN

Cheng FAN

Zhanhua ZHANG

Related Institution

Information Engineering University

State Key Laboratory of Complex Electromagnetic Environment Effects on Electronics and Information System

The Third Institute,Information Engineering University

Henan Key Laboratory of Information Security

Trusted Computing and Information Assurance Laboratory,Institute of Software,Chinese Academy of Sciences

⁰