基于工控系统功能码特征的同源攻击分析

doi:10.19678/j.issn.1000-3428.0057547

计算机工程 ›› 2020, Vol. 46 ›› Issue (7): 36-42. doi: 10.19678/j.issn.1000-3428.0057547

基于工控系统功能码特征的同源攻击分析

王建华, 陈永乐, 张壮壮, 连晓伟, 陈俊杰

太原理工大学信息与计算机学院, 太原 030024

收稿日期:2020-03-02 修回日期:2020-04-14 发布日期:2020-07-08
作者简介:王建华(1995-),男,硕士研究生,主研方向为物联网安全;陈永乐,副教授、博士;张壮壮、连晓伟,硕士研究生;陈俊杰,教授、博士。
基金资助:
山西省自然科学基金（201701D111002，201601D021074）；山西省重点研发项目（201903D121121）。

Same Origin Attack Analysis Based on Features of Industrial Control System Function Code

WANG Jianhua, CHEN Yongle, ZHANG Zhuangzhuang, LIAN Xiaowei, CHEN Junjie

College of Information and Computer, Taiyuan University of Technology, Taiyuan 030024, China

Received:2020-03-02 Revised:2020-04-14 Published:2020-07-08

摘要/Abstract

摘要： IP溯源是追踪攻击者源头的主要方法，工业控制系统（ICS）需要精确的IP溯源以提高其防护能力。现有IP溯源方法存在开销大、恶意IP所属组织识别效率低的问题。为此，通过采集和分析ICS蜜罐数据，提出一种基于工控协议功能码特征的同源攻击分析方法，以识别攻击行为相似的组织并提高IP溯源的效率和准确性。用工控协议功能码的粗粒度统计特征和细粒度序列特征来量化攻击行为，采用粗糙集和聚类模型分别对2类特征进行建模，在此基础上分析蜜罐数据中的同源攻击。实验结果表明，该方法具有较高的准确率和召回率，结合威胁情报后能够在蜜罐数据中发现包括shodan在内的10个恶意组织。

关键词: IP溯源, 工业控制系统, 功能码序列, 同源攻击分析, 恶意组织

Abstract: IP traceback is one of the main methods of attack group identification.Industrial Control System(ICS) need accurate IP traceback to improve their self-protection.However,existing IP traceback methods are costly and inefficient in identification of the group a malicious IP belongs to.To address the problem,by collecting and analyzing the honeypot data of ICS,this paper proposes a same origin attack analysis method based on ICS function code features,so as to find out the attack group with similar attack behavior and improve the efficiency and accuracy of IP traceback.This method uses coarse-grained statistical features and fine-grained sequence features of industrial control function codes to quantify the attack behavior.Then the two kinds of features are modeled by using coarse set and clustering model.On this basis,the same origin attacks in honeypot data are analyzed.Experimental results show that the proposed method can use threat intelligence to discover more than 10 malicious groups including shodan in honeypot data with a high accuracy and recall rate.

Key words: IP traceback, Industrial Control System(ICS), function code sequence, same origin attack analysis, malicious group

中图分类号:

TP393

王建华, 陈永乐, 张壮壮, 连晓伟, 陈俊杰. 基于工控系统功能码特征的同源攻击分析[J]. 计算机工程, 2020, 46(7): 36-42.

WANG Jianhua, CHEN Yongle, ZHANG Zhuangzhuang, LIAN Xiaowei, CHEN Junjie. Same Origin Attack Analysis Based on Features of Industrial Control System Function Code[J]. Computer Engineering, 2020, 46(7): 36-42.

https://www.ecice06.com/CN/Y2020/V46/I7/36

参考文献

[1] SPITZNER L.Honeypots:catching the insider threat[C]//Proceedings of the 19th Annual Computer Security Applications Conference.Washington D.C.,USA:IEEE Press,2004:15-26.
[2] MCGREW R,VAUGHN R B.Experiences with honeypot systems:development,deployment,and analysis[C]//Proceedings of the 39th Ha-waii International International Conference on Systems Science.Washington D.C.,USA:IEEE Press,2006:256-269.
[3] FRAUNHOLZ D,ZIMMERMANN M,HAFNER A,et al.Data mining in long-term honeypot data[C]//Proceedings of IEEE International Conference on Data Mining.Washington D.C.,USA:IEEE Press,2017:588-596.
[4] QIAO Yanchen,YUN Xiaochun,ZHANG Yongzheng.How to automatically identify the homology of different malware[C]//Proceedings of 2016 IEEE Trust-com/BigDataSE/ISPA.Washington D.C.,USA:IEEE Press,2016:12-36.
[5] WANG Liyan,XUE Jingfeng,CUI Yan,et al.Homology analysis method of worms based on attack and propagation features[M]//AVATANGELOU E,DOMMARCO R F,KLEIN M,et al.Communications in computer and information science.Berlin,Germany:Springer,2017:1-15.
[6] Shodan.Shodan is the world's first search engine for Internet-connected devices[EB/OL].[2020-02-15].https://www.shodan.io/.
[7] ICS security workspace[EB/OL].[2020-02-15].http://plcscan.org/blog/.
[8] SAVAGE S,WETHERALL D,KARLIN A,et al.Practical network support for IP traceback[J].IEEE/ACM Transactions on Networking,2002,9(3):226-237.
[9] SNOEREN A C,PARTRIDGE C,SANCHEZ L A,et al.Singlepacket IP traceback[J].IEEE/ACM Transactions on Networking,2002,10(6):721-734.
[10] TAO Yaodong,LI Ning,ZENG Guangsheng.Overview of industrial control system security[J].Computer Engineering and Applications,2016,52(13):8-18.(in Chinese)陶耀东,李宁,曾广圣.工业控制系统安全综述[J].计算机工程与应用,2016,52(13):8-18.
[11] GUARNIZO J D,TAMBE A,BUNIA S S,et al.SIPHON:to-wards scalable high-interaction physical honeypots[C]//Proceedings of the 3rd ACM Workshop on Cyber-Physical System Security.New York,USA:ACM Press,2017:26-39.
[12] KREIBICH C,CROWCROFT J.Honeycomb-creating intrusion detection signatures using honeypots[J].Computer Communication Review,2004,34(1):51-56.
[13] YEGNESWARAN V,GIFFIN J T,BARFORD P,et al.An architecture for generating semantics-aware signatures[C]//Proceedings of Conference on Usenix Security Symposium.[S.l.]:USENIX Association,2005:97-112.
[14] POUGET F,DACIER M.Honeypot-based forensics[EB/OL].[2020-02-15].http://pdfs.semanticscholar.org/935e/d80c40367c8ccf2155fe66e3e52bc0fcdaad.pdf.
[15] JIA Z,CUI X,LIU Q,et al.Micro-honeypot:using browser fingerprinting to track attackers[C]//Proceedings of 2018 IEEE International Conference on Data Science in Cyberspace.Washington D.C.,USA:IEEE Press,2018:197-204.
[16] LI K,YOU J,WEN H,et al.Collaborative intelligence analysis for industrial control systems threat profiling[C]//Proceedings of Future Technologies Conference.Berlin,Germany:Springer,2018:152-189.
[17] DACIER M,PHAM V H,THONNARD O.The wombat attack attribution method:some results[C]//Proceedings of International Conference on Information Systems Security.Berlin,Germany:Springer,2009:12-26.
[18] SHANG Wenli,ZENG Peng,WAN Ming,et al.Intrusion detection algorithm based on OCSVM in industrial control system[J].Security and Communication Networks,2016,9(10):1040-1049.
[19] MOORE A W,ZUEV D.Internet traffic classification using Bayesian analysis techniques[J].ACM SIGMETRICS Performance Evaluation Review,2005,33(1):50-56.
[20] ZHAO Yonghan,CHEN Bin,LI Mengyu.Parallel K-Medoids improved algorithm based on MapReduce[C]//Proceedings of 2018 International Conference on Advanced Cloud and Big Data.Washington D.C.,USA:IEEE Press,2018:156-168.
[21] TAO Jing.Clustering-based and density outlier detection method[D].Guangzhou:South China University of Technology,2014.(in Chinese)陶晶.基于聚类和密度的离群点检测方法[D].广州:华南理工大学,2014.
[22] AbuseIPDB.Making the Internet safer,one IP at a time[EB/OL].[2020-02-15].https://www.abuseipdb.com/.
[23] IPVOID.IP address tools online[EB/OL].[2020-02-15].https://www.ipvoid.com/ip-blacklist-check/.
[24] IBMX-Force Exchange.IBM security[EB/OL].[2020-02-15].https://exchange.xforce.ibmcloud.com.
[25] LUKAS K,KRUPP J,MAKITA D,et al.AmpPot:monitoring and defending against amplification DDoS attacks[EB/OL].[2020-02-15].https://christian-rossow.de/publications/amppot-raid2015.pdf.
[26] Censys.Actionable security insights about your attack surface[EB/OL].[2020-02-15].https://censys.io/.

选择文件类型/文献管理软件名称

选择包含的内容

基于工控系统功能码特征的同源攻击分析

Same Origin Attack Analysis Based on Features of Industrial Control System Function Code

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 5

编辑推荐

Metrics

本文评价

[1]	廉文娟, 赵朵朵, 范修斌. 基于CFL_BLP模型的CFL SSL安全通信协议[J]. 计算机工程, 2021, 47(6): 152-163.
[2]	张瑞, 陈红卫. 基于特征优化与SVPSO的工控入侵检测[J]. 计算机工程, 2020, 46(4): 19-25.
[3]	周伟平, 杨维永, 王雪华, 茅兵. 面向工业控制系统的渗透测试工具研究[J]. 计算机工程, 2019, 45(8): 92-101.
[4]	曾凡毅, 经小川, 孙运乾. 基于单向传输协议的网间安全交换技术[J]. 计算机工程, 2019, 45(11): 159-165.
[5]	王军;王宏;徐皑冬. UWB技术在工业控制系统中的应用[J]. 计算机工程, 2008, 34(2): 242-244.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于工控系统功能码特征的同源攻击分析

Same Origin Attack Analysis Based on Features of Industrial Control System Function Code

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 5

编辑推荐

Metrics

本文评价