CN112114579A - A security measurement method for industrial control system based on attack graph - Google Patents

Abstract

The invention relates to an industrial control system security measurement method based on an attack graph. The method includes: acquiring industrial control network topology structure information, detecting devices of a specific industrial control system, mastering the device information in the industrial control network, and performing device correlation analysis. Analysis; according to the detection results of the equipment in the industrial control network, the equipment vulnerability information is collected; according to the topology structure and equipment vulnerability information, the method based on the graph database stores the format in a graphical format, and uses nodes and relationships to represent the graph structure to generate a system attack graph ; According to the generated system attack graph, according to three levels of vulnerability node measurement, device node measurement, and system security measurement, network security measurement for a specific industrial control system is carried out, and the attack path is analyzed. The method finds potential threats to the greatest extent, greatly shortens the analysis period of industrial control system security measurement, improves measurement efficiency, and lays a foundation for industrial control system protection work.

Description

A security measurement method for industrial control system based on attack graph

technical field

The invention relates to an industrial control system security measurement method based on an attack graph, belonging to the technical field of network security.

Background technique

In recent years, industrial control systems have gradually developed towards informatization, which not only introduces diversified methods in the Internet, but also brings various attack threats to industrial control systems. Highly information-based industrial control systems need to face changes in the network environment and the potential impact of network components on the system. Aiming at the complex operating environment of industrial control systems and the diversification of attack methods, a security measurement method for industrial control systems based on attack graphs is proposed. Provide data support for subsequent system security analysis and protect mission-critical assets from potential threat sources.

For example, Chinese patent document CN110533754A provides an interactive attack graph display system and display method based on a large-scale industrial control network. The display system includes a json file construction module, a network topology generation module, a scene roaming processing module, an attack graph generation module and an interactive attack graph. Event processing module; this method starts from the attack target and generates the attack graph in reverse, which greatly reduces the complexity and availability of the attack graph. The attack graph display system adopts an interactive form, allowing users to switch attack targets by clicking, and generate real-time critical attack paths based on the determined targets, which greatly improves the visual management of attack graphs. It is convenient for network security analysis and evaluation of security operation and maintenance personnel and security analysts, and can effectively help network security incident handlers to identify network attack paths early and defend key points. Chinese patent document CN108156114A provides a method and device for determining key nodes in a network attack graph of a power information physical system. The method includes: respectively acquiring at least one feature value of all nodes in the attack graph; Weight; determining a key node from all the nodes according to the at least one characteristic value and the weight. By obtaining at least one eigenvalue of all nodes in the attack graph, the importance of each node can be quantified; by determining the weight of each eigenvalue, the eigenvalues can be weighed; finally, according to the eigenvalue and the corresponding weight, all nodes The key nodes are determined in the system, and all nodes are considered comprehensively, so as to realize the identification of key nodes in the system attack graph from multiple aspects and dimensions, and solve the problem of uncertainty in the security protection focus of the attack graph. Chinese patent document CN108629474A discloses a process security assessment method based on an attack graph model, the method includes the following steps: designing a security node according to the security attribute of the security control system; forming a process scheme according to the business process logic of the designed node; The design of the process scheme is realized by establishing a tree diagram; the evaluation model of the designed process scheme is carried out, and the evaluation calculation is performed to generate an evaluation conclusion; the process scheme evaluation includes the establishment of a process safety evaluation system, a reliability evaluation system and an operation efficiency evaluation system. And based on the evaluation values of these three evaluation system indicators, the comprehensive evaluation results of the system are given through the comprehensive scoring model; according to the parameter level of the importance, achievability and complexity of the weak security nodes, the optimization strategy for the current process scheme is given. The method solves the uncertainty caused by human intervention, and improves the accuracy, reliability and efficiency of safety assessment results.

At present, there are few security measurement methods for industrial control systems, lacking a system-wide security measurement scheme, and it cannot consider the vulnerability relationship between system devices. Due to the complexity of the industrial control system topology and the difficulty in selecting and quantifying the security indicators in the measurement, the current security measurement schemes are mostly based on qualitative analysis. Therefore, in order to solve the global measurement of the security quantification of the industrial control system, it is urgent to design a security measurement method for the global measurement of the industrial control system.

SUMMARY OF THE INVENTION

In view of the shortcomings of the prior art, the present invention provides a security measurement method based on an industrial control system attack graph. The attack graph represents the detailed information of the attacked process of the industrial control system in a graph structure. The method comprehensively considers the special hierarchical structure of the industrial control system equipment and its Vulnerability and dependencies, establish the correlation model between devices and vulnerabilities, and between devices, and show possible attack paths. Finally, this method combines the attack paths with the indicators in the attack graph, which can realize the globalization of the industrial control system. security measure.

Terminology Explanation:

1. CVE-NVD (Common Vulnerabilities and Exposures-National Vulnerability Database), Common Vulnerability and Risk Exposure-National Vulnerability Database.

2. CNNVD (China National Vulnerability Database of Information Security), China National Information Security Vulnerability Database.

3. ICS (Industrial control system) Vulnerability Database, industrial control system vulnerability database.

4. CWE (Common Weakness Enumeration), an enumeration of common weaknesses.

5. CAPEC (Common Attack Pattern Enumeration and Classification), which can be used to enumerate and classify attack patterns.

6. Availability, indicating the probability that this vulnerability is successfully exploited to achieve the attack effect.

7. Vulnerability hazard, indicating the severity of the impact after the vulnerability is successfully exploited.

The technical scheme of the present invention is as follows:

An attack graph-based security measurement method for industrial control systems, comprising the following steps:

Step 1: Acquire industrial control network topology information, detect devices of a specific industrial control system, master device information in the industrial control network, and analyze device associations;

Step 2, according to the detection result of the equipment in the industrial control network, collect equipment vulnerability information;

Step 3: According to the topology structure and equipment vulnerability information, the method based on the graph database stores the format in a graphical format, and uses nodes and relationships to represent the graph structure to generate a system attack graph;

Step 4: According to the generated system attack graph, according to three levels of vulnerability node measurement, device node measurement, and system security measurement, network security measurement is performed on a specific industrial control system, and the attack path is analyzed.

Preferably, in step 1, the GRASSMARLIN tool is used to obtain the industrial control network topology information.

Preferably, in step 1, acquiring the industrial control network topology information includes topology planning, system configuration, and access control rules of security devices in the system design document; Connect relationships and extract to restore system topology.

Preferably, in step 1, detecting the equipment of a specific industrial control system refers to using the GRASSMARLIN tool to monitor the topology of the industrial control system in real time, so as to detect the equipment newly added to the industrial control system, and the GRASSMARLIN tool adopts a passive detection method to realize the detection of the detection system. It can collect information and reduce the impact of the detection process on the working status of the equipment in the industrial control system.

Preferably, in step 1, grasping the device information in the industrial control network refers to reading the device information in the system design document and the system configuration file, extracting the device type, device model, and system version, as the subsequent device vulnerability information obtained. Data basis.

Preferably, in step 1, the analysis of the association of the devices refers to formatting the association between the devices according to the system topology information obtained from the system design document, the system configuration file and the access control rules of the security device, The connection relationship between devices is uniformly defined as link, A link B indicates that device A has a link to device B, A can access B, and link is a directed relationship.

Preferably, in the process of real-time monitoring of the industrial control system topology by the GRASSMARLIN tool, the detection results are stored in XML format, and the detection results of the GRASSMARLIN tool are periodically read at a low frequency, and the relationship is extracted for the updated devices, and the newly added devices are added to the system. , and update the system equipment that has information interaction with the new equipment, simplify the connection relationship between the source IP and the destination IP in the same group, and remove redundant data to achieve dynamic acquisition of the system topology; at the same time, for the original data and updated data, according to The order of the probes is used to sort the topological data.

Preferably, in step 2, the collection of device vulnerability information includes the construction of a vulnerability information database and the acquisition of device vulnerabilities;

The construction of vulnerability information database includes vulnerability information collection and vulnerability information processing; vulnerability information collection is mainly based on CVE-NVD vulnerability database, CNNVD and ICS Vulnerability Database are extended security databases, and CWE and CAPEC are vulnerability correlation information databases to build a security knowledge base. The collected vulnerability information is stored in the MySQL database; the vulnerability information processing takes the CNNVD and CVE vulnerability knowledge base as the main body, matches and correlates all the vulnerability information imported into the MySQL database, and introduces CWE as the vulnerability description and vulnerability classification and utilization discrimination The basis for the attack, combined with CAPEC, describe the premise, technical reserves, methods and consequences of exploiting vulnerabilities;

Device vulnerability acquisition: Use scanning tools to scan system devices for vulnerabilities, configure the scanning tools according to the acquired system device information, and complete the scanning of device vulnerability information; and then associate devices with vulnerabilities according to the device vulnerability information obtained by scanning. Indicates that a device can be associated with one or more vulnerabilities, and the connection relationship between the device and the vulnerability is defined as has_vul_at, DEVICE1 has_vul_at VUL1 indicates that the device 1 has a vulnerability numbered VUL1; the device vulnerability information is matched with the information in the vulnerability information database, each A vulnerability can obtain the atomic attack template of "CNNVD description-CVE vulnerability number-CWE vulnerability report-CAPEC attack method-CVSS score", which provides input data for the generation of subsequent attack graphs.

Preferably, in step 3, the nodes in the attack graph include device nodes and vulnerability nodes;

The device node information includes the service information, open port information and IP information where the device vulnerability is located. The device node information is used as the attribute of the device node. The service port is described;

The vulnerability node information includes the CVE\CNNVD number, CWE classification, privilege escalation capability identifier and CVSS score in the atomic attack rule. The vulnerability node information is integrated as a node attribute on the vulnerability node identified by the vulnerability ID, and the vulnerability node information uses a quadruple. That is, the vulnerability ID, vulnerability number, vulnerability type, and vulnerability score are described;

According to the results of network topology analysis and vulnerability information collection, the data is preprocessed and summarized into a device information table, a vulnerability information table, and a device relationship table, which are used as the input of the attack graph generation algorithm.

Preferably, in step 3, generating a system attack graph is to generate an attack graph based on a Neo4j graph database, and follow the attribute graph model to store and manage data, where nodes in the attack graph are used to represent entities, and relationships are used to represent connections between entities; Fill the node attributes of the attack graph with the device information table and the vulnerability information table, fill the node relationship with the device relationship table, select the starting node and the target node, and generate the attack graph after multiple traversal.

Preferably, in step 4, the vulnerability node metric quantifies the availability and vulnerability damage of the vulnerability node according to the scanned device vulnerability information; the exploitability of the vulnerability node is defined by the "attack possibility" field in the CAPEC library, and the attack possibility is The quantification of {low, medium, high} is expressed as {0.3, 0.6, 0.9}, a low score indicates a low possibility of being attacked, and a high score indicates a high possibility of being attacked; the damage score of the vulnerability node adopts the general security vulnerability scoring system CVSS Vulnerability evaluation score, the full score is 10 points, the higher the score, the greater the vulnerability damage, the lower the score, the smaller the vulnerability damage.

Preferably, in step 4, the device node metric is quantified according to the probability of the device node being attacked and the risk score of the device node;

a. The probability of the device node being attacked

For the vulnerable node connected to each device node, the attack probability of the device node is calculated according to its availability, as shown in formula I:

Among them, U _self represents the attack probability of the device node, _ui represents the availability of the i-th vulnerable node connected to the device node, k represents the number of all vulnerable nodes connected to the device node, and the number of vulnerable nodes connected to the device node The greater the number of vulnerable nodes, the higher the probability of the device node being attacked;

b. Device Node Hazard Score

Based on the availability of the connected vulnerable nodes, weighted damage calculation is performed on the vulnerable nodes to obtain the risk score of the device node, as shown in formula II:

Among them, R _self represents the risk score of the device node, _ui and u _j represent the availability of the i-th and j-th vulnerability nodes connected to the device node, and ri represents the _i -th vulnerability node connected to the device node. vulnerability hazards.

Preferably, in step 4, the system security metric includes a starting node metric and a non-starting node metric;

a. Start Node Metrics

Since the starting node has obtained the permission, it is not attacked, so the attack probability of the starting device node is 1 by default, which means to obtain all the permissions of the device. Since the starting node has no forward node, the in-degree is 0. Therefore, the risk score of the starting node is equal to the own risk score of this node;

b. Non-starting node metrics

When the non-starting node considers the vulnerable nodes connected to this node, it also combines the attack probability of the upper-layer device node and the device risk score to calculate the cumulative attack probability of the upper-layer device node and the device node of this layer, as well as the device risk score. The system The safety metric is calculated according to the hazard scores of equipment nodes accumulated in multiple layers;

The attack probability of the non-initial node is calculated as formula III:

Among them, d _i represents the in-degree of the node, and U _m represents the attack probability of the m-th upper-layer node connected to the device node; this measurement method considers the in-degree of the node and the impact of the attack probability of the upper-layer node on the node at this layer , the greater the in-degree of the node, the greater the probability of the node being attacked; the greater the probability of the upper node being attacked, the greater the probability of the node being attacked;

The risk score of non-initial nodes is calculated as formula IV:

Among them, U _m and U _n represent the attack probability of the m-th and n-th upper-layer nodes connected to the device node, and R _m represents the risk score of the m-th upper-layer node connected to the device node;

The risk score calculation of non-initial nodes takes into account the impact of the attack probability of the upper node on the node at this layer, and at the same time, the risk score of the upper node is cumulatively calculated. The greater the in-degree of the node, the greater the node risk score; The larger the risk score of the node in this layer is, the larger the risk score of the node in the upper layer is, the larger the risk score of the node in this layer is, and finally the risk score R _dest of the target node is calculated through the multi-layer attack path cumulative calculation.

Preferably, in step 4, the attack paths include nested paths and parallel paths; quantitatively analyze the key attack paths in combination with the system security metric value, and introduce asset value indicators to measure during the analysis process. It is jointly decided that the asset importance index is divided into ten grades from 1-10, 10 is very important, 1 is very unimportant; at the same time, according to the in-out degree of nodes appearing in the current attack graph, the highest in-out degree shall prevail. The remaining in-out degrees are normalized. The in-out degrees of the starting node and the target node are set to 1 by default, and no weight reduction is performed. The final asset value is obtained by multiplying the asset importance and the in-out degree, as shown in formula V:

P _value = P _significance *d _io (V)

Among them, P _value represents asset value, P _significance represents asset importance, and _dio represents the normalized node in-out degree;

a. Nested Path Analysis

The nodes in the path set of nested paths do not include common starting nodes. For the critical path selection in this case, the calculation is as follows:

Among them, Path _sign is the key index of the path, U _j represents the attack probability of the jth device node in the path set, R _i represents the risk score of the ith device node in the path set, and P _valuei represents the ith device node in the path set. The key path of the nested path is calculated based on the number of attack hops. In general, the path with less attack hops is the key path. Only when the attack rate and danger score of the intermediate hop nodes are large, the attack Only paths with more hops may become critical paths;

b. Parallel path analysis

The path set of the parallel attack path is expressed as N parallel nodes except the common starting node and the ending node. For the selection of the critical path in this case, the calculation is as follows:

Path _sign =max{U _i *R _i *P _valuei }i=(1, 2,...k) (VII)

U _i represents the attack probability of the ith device node in the path set, R _i represents the risk score of the ith device node in the path set, and P _valuei represents the asset value of the ith device node in the path set; The selection is obtained by comparing the key indices of N parallel paths;

Synthesizing the analysis results of nested paths and parallel paths, and calculating the importance of multiple paths through quantitative indicators, the key attack paths are obtained.

A server that includes:

one or more processors;

a storage device on which one or more programs are stored,

When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned attack graph-based industrial control system security measurement method.

A computer-readable medium having a computer program stored thereon, wherein the computer program implements the above-mentioned attack graph-based security measurement method for an industrial control system when executed by a processor.

Technical characteristics and beneficial effects of the present invention:

1. The present invention uses CVE-NVD as the main body, CNNVD and ICS Vulnerability Database as the extended security database, and CWE and CAPEC as the vulnerability correlation information database to jointly build an overall security knowledge base. At the same time, combined with the scanning results of various tools, the isolated data is filtered, correlated, and fused to generate an attack graph suitable for industrial control systems, and hierarchically measure system security to provide decision support and situational awareness. The method associates network threats with industrial control system equipment according to vulnerability dependencies, discovers potential threats to the greatest extent, greatly shortens the analysis cycle of industrial control system security measurement, improves measurement efficiency, and lays a foundation for industrial control system protection.

2. This method proposes an attack graph-based security measurement method for industrial control systems, which can visualize the system attack path by using technologies such as asset detection, vulnerability scanning, vulnerability exploitation, graph data-based attack graph generation, and hierarchical security metrics. , and measure the security of the system under test to provide guarantee for the safe operation of the industrial control system, which can cover a variety of vulnerabilities and industrial control equipment types; can generate attack graphs for any starting point and attack target; can provide data for further system analysis support. The practical scope includes supporting the generation of attack graphs for any attack starting point and attack target in the industrial control system, as well as the measurement of the security of the industrial control system, providing data support for the security analysis of the industrial control system, and has a wide range of application prospects.

Description of drawings

Figure 1 is an architecture diagram of a security measurement method based on an attack graph;

Fig. 2 is a schematic diagram of the topology structure of an industrial control system;

Fig. 3 is the vulnerability information association schematic diagram of attack template;

Fig. 4 is the flow chart of attack graph generation algorithm;

Figure 5 is a schematic diagram of attack graph generation;

6 is a schematic diagram of an attack path, wherein (a) is a schematic diagram of a nested attack path, and (b) is a schematic diagram of a parallel attack path;

Detailed ways

The present invention will be further described below with reference to the embodiments and the accompanying drawings, but is not limited thereto.

Example 1:

This embodiment provides an attack graph-based security measurement method for an industrial control system, including the following four steps, and a schematic diagram of the overall architecture of the method is shown in FIG. 1 :

Step 1: Obtain the industrial control network topology information, detect the equipment of a specific industrial control system (that is, the target industrial control system for which security measurement is to be performed), master the device information in the industrial control network, and analyze the device association;

The first step is the foundation, mainly to obtain the information and related information of the equipment of the target industrial control system in the entire industrial control network;

In step 2, according to the detection result of the device in the industrial control network, that is, the device information and related situation of the specific industrial control system in step 1, the device vulnerability information is collected;

Step 3: According to the topology structure and equipment vulnerability information, the method based on the graph database stores the format in a graphical format, and uses nodes and relationships to represent the graph structure to generate a system attack graph;

Step 4: According to the generated system attack graph, according to three levels of vulnerability node measurement, device node measurement, and system security measurement, network security measurement is performed on a specific industrial control system, and the attack path is analyzed.

Specifically, in step 1, use the GRASSMARLIN tool to obtain the industrial control network topology, and the obtained industrial control network topology information includes the topology planning, system configuration, and access control rules of the security equipment in the system design document; access control rules, read the connection relationship between system devices and extract them to restore the system topology. At the same time, the device information in the system design document and system configuration file is read, and the device type, device model, and system version are extracted as the data basis for obtaining device vulnerability information.

In addition, in view of the vulnerability and real-time characteristics of the industrial control system, the GRASSMARLIN tool is used to monitor the topology of the industrial control system in real time to detect new devices added to the industrial control system (the ultimate purpose is to realize the dynamic update of the system attack graph), and The GRASSMARLIN tool uses passive detection to collect information on the detection system, reducing the impact of the detection process on the working state of the equipment in the industrial control system. That is, the topology information collection shown in Figure 1.

In the process of real-time monitoring of the industrial control system topology by the GRASSMARLIN tool, the detection results are stored in XML format, and the detection results of the GRASSMARLIN tool are read regularly at a low frequency (the specific situation should be judged according to the particularity of each system and set by the technicians). As a result, the relationship is extracted for the updated device, the newly added device is added to the system, and the system device that has information interaction with the new device is updated, the connection relationship between the source IP and the destination IP in the same group is simplified, and redundant data is removed to achieve Dynamic acquisition of system topology; at the same time, for the original data and updated data, the topology data is sorted according to the order of detection.

Mastering the device information in the industrial control network refers to reading the device information in the system design document and system configuration file, extracting the device type, device model, and system version, as the data basis for subsequent device vulnerability information acquisition.

The analysis of device associations refers to formatting the association relationships between devices according to the system topology information obtained from system design documents, system configuration files, and access control rules of security devices, and uniformly defining the connection relationships between devices. For link, A link B indicates that device A has a link to device B, A can access B, and link is a directed relationship.

In step 2, the collection of device vulnerability information includes the construction of a vulnerability information database and the acquisition of device vulnerabilities;

The construction of vulnerability information database includes vulnerability information collection and vulnerability information processing. Vulnerability information collection is mainly based on CVE-NVD vulnerability database, CNNVD and ICS Vulnerability Database are extended security databases, and CWE and CAPEC are vulnerability correlation information databases to build a security knowledge base. The collected vulnerability information (vulnerability information in the vulnerability database) is stored in the MySQL database; the vulnerability information processing takes the CNNVD and CVE vulnerability knowledge bases as the main body, and matches all the vulnerability information imported into the vulnerability information database (that is, the MySQL database). Correlation, introducing CWE as the basis for vulnerability description, vulnerability classification and exploitability discrimination, combined with CAPEC, describing the premise, technical reserve, method and consequences of exploiting vulnerabilities;

The collected vulnerability information content items include: vulnerability name, CNNVD number, basic score, CVE number, hazard level, vulnerability type, vulnerability release time, vulnerability update time, threat type, vendor, vulnerability description, solution, affected entity, patch , CWE number, CWE name, description of the weakness, other related weaknesses, the method of introducing the weakness, the application impact of the weakness, the related attack method, the attack possibility, the attack domain, the attack mechanism, the prerequisites, and the required skills.

The schematic diagram of the vulnerability information association of the attack template is shown in Figure 3. Taking the CVE-NVD vulnerability knowledge base as the main body, fill in the vulnerability name, CNNVD number, CVE number, hazard level, vulnerability type, vulnerability release time, vulnerability update time, threat type, manufacturer, vulnerability description, Solutions, Affected Entities, Patches. Each CNNVD vulnerability number corresponds to a CVE number, which can be associated with the vulnerability information in the CVE vulnerability page according to the CVE number. The CVE vulnerability page will provide the associated CWE number to link to the CWE security event database. Common Weakness Enumeration CWEs are categorized according to the vulnerability, and for each CWE number a description of the vulnerability is provided. According to the acquired weaknesses, describe the remaining related weaknesses, the method of introducing the weaknesses, the application impact of the weaknesses, and the related attack methods, and fill in the exploit conditions, exploit methods, and attack results of the vulnerabilities with the vulnerabilities as the core. At the same time, for the multiple CAPEC numbers contained in the related attack methods, according to the attack possibility, attack domain, attack mechanism, prerequisites, and required skills attack information provided on the CAPEC page, complete the attack prerequisites and attack requirements in the attack template. Supplementary skills. In addition, in order to give the feasibility analysis and severity judgment of specific vulnerabilities, it can be linked to CVSS through the CVE number, and CVSS provides the severity classification and risk score judgment of each vulnerability. Complete the information integration and correlation of multiple vulnerability information bases.

Device vulnerability acquisition: Use open source scanning tools (such as Nessus, OpenVAS, etc.) and customized scanning tools of industrial control manufacturers to scan system devices for vulnerabilities, and configure the scanning tools according to the acquired system device information to complete the scanning of device vulnerability information; Compared with traditional networks, industrial control systems face more stringent security requirements, and the vulnerability of industrial control devices should be considered when scanning for device vulnerabilities. According to the sensitivity characteristics of industrial control systems, different scanning methods are adopted for vulnerability scanning of industrial control equipment and vulnerability scanning of general Internet devices according to different types of equipment. For industrial control system equipment, vulnerability scanning is performed at low frequency, while general Internet equipment is scanned at high frequency. The multi-frequency scanning scheme can reduce the risk of increasing network load and detection to industrial control equipment by injecting detection data and reporting. At the same time, the real-time performance of device vulnerability information acquisition is ensured.

Then, according to the device vulnerability information obtained by scanning, the device and the vulnerability are associated to indicate that a device can be associated with one or more vulnerabilities, and the connection relationship between the device and the vulnerability is defined as has_vul_at, DEVICE1 has_vul_atVUL1 indicates that the device 1 has a vulnerability numbered VUL1 ; Match the device vulnerability information with the information in the vulnerability information database, and each vulnerability can obtain an atomic attack template of "CNNVD description-CVE vulnerability number-CWE vulnerability report-CAPEC attack method-CVSS score" for the generation of subsequent attack graphs Provide input data. As shown in Figure 3.

In step 3, the attack graph includes nodes and edges, the edges are the attackable paths, and the nodes in the attack graph include device nodes and vulnerable nodes;

The device node information includes the service information, open port information and IP information where the device vulnerability is located. The device node information is used as the attribute of the device node. The service port is described;

The vulnerability node information includes the CVE\CNNVD number, CWE classification, privilege escalation capability identifier and CVSS score in the atomic attack rule. The vulnerability node information is integrated as a node attribute on the vulnerability node identified by the vulnerability ID, and the vulnerability node information uses a quadruple. That is, the vulnerability ID, vulnerability number, vulnerability type, and vulnerability score are described;

According to the results of network topology analysis and vulnerability information collection, the data is preprocessed and summarized into a device information table, a vulnerability information table, and a device relationship table, which are used as the input of the attack graph generation algorithm. As shown in the following table, in the device relationship table, "Y" means that the device has a connection relationship, and "-" means that there is no connection relationship between the devices.

Table 1: Equipment Information Table

Table 2: Vulnerability Information Table

Table 3: Equipment relationship table

In step 3, the system attack graph is generated, which is based on the Neo4j graph database to generate the attack graph, and follows the attribute graph model to store and manage data. The nodes in the attack graph are used to represent entities, and the relationship is used to represent the connection between entities; the device information is used to represent the connection between entities. The table and vulnerability information table fill the node attributes of the attack graph, use the device relationship table to fill the node relationship, select the starting node and the target node, and generate the attack graph after multiple traversal.

Taking the data in the above three tables as the input of the attack graph generation algorithm, the algorithm flow chart is shown in Figure 4. First, import device information, vulnerability information, device relationship and vulnerability matching into the Neo4j graph database. According to the atomic attack rule model, the vulnerability nodes that do not meet the model utilization and the device nodes that do not meet the attack conditions are identified. Remove devices that are not in the target route and orphaned vulnerable nodes. Finally, the attackers and targets are defined, the information in the current graph database is returned, and an attack graph against the system is constructed.

Taking the industrial control system in Figure 5 as an example, the starting node is defined as the MES system host, and the target node is PLC1, and an attack graph is generated, including 17 nodes and 19 edges. Since the MES system PC3 includes two exploitable vulnerabilities, this attack graph contains a total of 12 attack paths.

In step 4, the network security measurement adopts a hierarchical measurement method, and measures the security of the industrial control network according to the node type, that is, the vulnerability node measurement, the equipment node measurement, and the system security measurement. There are two additional attributes of vulnerability nodes: availability and vulnerability hazards. Availability indicates the probability that this vulnerability is successfully exploited to achieve an attack effect. Vulnerability compromise indicates the severity of the impact of a successful exploit. The additional attributes of device nodes are also divided into two types: attack probability and device risk score. The probability of being attacked is related to the availability of vulnerable nodes connected to the device, indicating the probability that the device is successfully attacked. The device risk score is related to the availability and vulnerability hazards of vulnerable nodes connected to the device, indicating the degree of impact of the device being successfully attacked.

Calculations for nodes are divided into two categories: starting nodes and non-starting nodes. The starting node only needs to consider the situation of the vulnerable node connected to this node; the non-starting node should also consider the attack probability of the upper-layer device node and the device risk score while considering the vulnerable node connected to this node. The system security measure is based on multiple factors. The hazard scores of the device nodes accumulated by the layer are calculated.

(1) Vulnerable node metrics quantify the availability of vulnerable nodes and vulnerability hazards according to the scanned device vulnerability information; the exploitability of vulnerable nodes is defined by the "attack possibility" field in the CAPEC library, and the attack possibility {low, Medium, high} is quantified as {0.3, 0.6, 0.9}, a low score indicates a low probability of being attacked, and a high score indicates a high probability of being attacked; the hazard score of the vulnerability node adopts the vulnerability assessment score of the general security vulnerability scoring system CVSS, The full score is 10 points, the higher the score, the greater the vulnerability damage, and the lower the score, the smaller the vulnerability damage.

(2) The device node metric is quantified according to the attack probability of the device node and the risk score of the device node;

a. The probability of the device node being attacked

For the vulnerable node connected to each device node, the attack probability of the device node is calculated according to its availability, as shown in formula I:

Among them, U _self represents the attack probability of the device node, _ui represents the availability of the i-th vulnerable node connected to the device node, k represents the number of all vulnerable nodes connected to the device node, and the number of vulnerable nodes connected to the device node The greater the number of vulnerable nodes, the higher the probability of the device node being attacked;

b. Device Node Hazard Score

Based on the availability of the connected vulnerable nodes, weighted damage calculation is performed on the vulnerable nodes to obtain the risk score of the device node, as shown in formula II:

Among them, R _self represents the risk score of the device node, _ui and u _j represent the availability of the i-th and j-th vulnerability nodes connected to the device node, and ri represents the _i -th vulnerability node connected to the device node. vulnerability hazards.

(3) System security metrics include start node metrics and non-start node metrics;

a. Start Node Metrics

Since the starting node has obtained the permission, it is not attacked, so the attack probability of the starting device node is 1 by default, which means to obtain all the permissions of the device. Since the starting node has no forward node, the in-degree is 0. Therefore, the risk score of the starting node is equal to the own risk score of this node.

b. Non-starting node metrics

When the non-starting node considers the vulnerable nodes connected to this node, it also combines the attack probability of the upper-layer device node and the device risk score to calculate the cumulative attack probability of the upper-layer device node and the device node of this layer, as well as the device risk score. The system The safety metric is calculated according to the hazard scores of equipment nodes accumulated in multiple layers;

The attack probability of the non-initial node is calculated as formula III:

Among them, d _i represents the in-degree of the node, and U _m represents the attack probability of the m-th upper-layer node connected to the device node; this measurement method considers the in-degree of the node and the impact of the attack probability of the upper-layer node on the node at this layer , the greater the in-degree of the node, the greater the probability of the node being attacked; the greater the probability of the upper node being attacked, the greater the probability of the node being attacked;

The risk score of non-initial nodes is calculated as formula IV:

Among them, U _m and U _n represent the attack probability of the m-th and n-th upper-layer nodes connected to the device node, and R _m represents the risk score of the m-th upper-layer node connected to the device node;

The risk score measurement method of non-starting nodes considers the impact of the attack probability of the upper node on the node at this layer, and simultaneously calculates the risk score of the upper node. The greater the in-degree of the node, the greater the risk score of the node; The larger the value, the greater the risk score of the node in this layer; the greater the risk score of the upper node, the greater the risk score of the node in this layer, and finally the risk score R _dest of the target node is calculated through the multi-layer attack path cumulative calculation.

In step 4, the attack paths include nested paths and parallel paths; the key attack paths are quantitatively analyzed in combination with system security metrics, and asset value indicators are introduced to measure during the analysis process. The asset importance index is divided into ten grades from 1 to 10 (the asset importance index needs to be determined according to expert experience), 10 is very important, 1 is very unimportant; at the same time, according to the node in and out degrees appearing in the current attack graph, Take the highest in-out degree as the criterion, and normalize the remaining in-out degrees. The in-out degree of the starting node and the target node is 1 by default, and no weight reduction is performed. Taking the attack graph shown in Figure 6 as an example, the in-out degree = {2, 5}, after normalization, the node with in-out degree 5 becomes 1, and the node with in-out degree 2 becomes 0.4. The final asset value is obtained by multiplying the asset importance and the degree of access, as shown in formula V:

P _value = P _significance *d _io (V)

Among them, P _value represents asset value, P _significance represents asset importance, and _dio represents the normalized node in-out degree;

Combine the above indicators to analyze the key attack paths in the attack graph. There are two types of branch paths in the attack path, one is nested path analysis, and the other is parallel path analysis, as shown in Figure 6.

a. Nested Path Analysis

As shown in (a) of Figure 6, the attack path of MES PC1-->MES PC2-->MES PC3 includes the path of MESPC1-->MES PC3. The nodes in the path set of the nested path do not include the common starting node: Path1={MESPC2}, Path2={MES PC2, MES PC3}, for the selection of the critical path in this case, the calculation is as follows:

Among them, Path _sign is the key index of the path, U _j represents the attack probability of the jth device node in the path set, R _i represents the risk score of the ith device node in the path set, and P _valuei represents the ith device node in the path set. The key path of the nested path is calculated based on the number of attack hops. In general, the path with less attack hops is the key path. Only when the attack rate and danger score of the intermediate hop nodes are large, the attack A path with a large number of hops may become a critical path, which depends on different target industrial control systems and is judged by technicians based on long-term work experience; taking (a) in Figure 6 as an example, according to actual experience, define MES PC2 and MES PC3 asset importance is 6, and the normalized results of its in-out degree are 0.4. Path1 _sign =0.9*9.9*2.4=21.384, Path2 _sign =0.3*0.9*9.9*2.4+0.3*6.9*2.4=11.3832. Therefore, the critical path in the nested attack path is Path1, that is, the MES PC1-->MES PC3 path.

b. Parallel path analysis

As shown in (b) of Figure 6, the attack path of database server-->PLC1 includes three parallel attack paths: database server-->operator station-->PLC1, database server-->engineering station -->PLC1, database server -->SCADA system -->PLC1. The path set of the parallel attack path is expressed as three parallel nodes except the common start node and the end node. Path{operator station, engineer station, SCADA system} selects the critical path in this case, and the calculation is as follows:

Path _sign =max{U _i *R _i *P _valuei }i=(1, 2,...k) (VII)

U _i represents the attack probability of the ith device node in the path set, R _i represents the risk score of the ith device node in the path set, and P _valuei represents the asset value of the ith device node in the path set; The selection is obtained by comparing the key indices of the three parallel paths;

Taking (b) in Figure 6 as an example, according to actual experience, the asset importance of the operator station is defined as 8, the asset importance of the engineer station is 7, and the asset importance of the SCADA system is 9. 0.4. Path _sign =max{0.6*7.8*3.2, 0.8*9.8*2.8, 0.9*6.9*3.6}=max{14.976, 21.952, 22.356}. Therefore, the critical path in the parallel attack path is Path3, that is, the path of database server --> SCADA system --> PLC1.

Based on the analysis results of nested paths and parallel paths, it can be seen that a key path of the attack graph is MES PC1-->MES PC3-->Database server-->SCADA system-->PLC1. Calculate the importance of multiple paths through quantitative indicators, and obtain the critical attack path. The critical attack path of the system, which comprehensively considers the asset value, attack possibility, and vulnerability damage, can reflect the security situation of the key parts of the system. At the same time, the vulnerable points of the system can be accurately located according to the path score, device score and vulnerability score. In addition, according to the detailed information of the vulnerabilities provided in the vulnerability database, it is possible to quickly understand the vulnerability attributes, find solutions, and provide data support for the security protection of industrial control systems.

Example 2:

A server that includes:

one or more processors;

a storage device on which one or more programs are stored,

When the one or more programs are executed by the one or more processors, the one or more processors implement the attack graph-based industrial control system security measurement method described in Embodiment 1.

Example 3:

A computer-readable medium having a computer program stored thereon, wherein, when the computer program is executed by a processor, the attack graph-based industrial control system security measurement method described in Embodiment 1 is implemented.

The above are only specific embodiments of the present invention, and the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention are all should be included within the protection scope of the present invention.

Claims (10)

1. An industrial control system security measurement method based on an attack graph is characterized by comprising the following steps:

acquiring topological structure information of an industrial control network, detecting equipment of a specific industrial control system, grasping equipment information in the industrial control network, and analyzing the equipment association condition;

step two, collecting equipment vulnerability information aiming at the detection result of the equipment in the industrial control network;

step three, according to the topological structure and the equipment vulnerability information, storing the format in a graphical format by a graph database-based method, and representing the graph structure by adopting nodes and relations to generate a system attack graph;

and step four, according to the generated system attack graph, performing network security measurement on the specific industrial control system according to three levels of vulnerability node measurement, equipment node measurement and system security measurement, and analyzing an attack path.

2. The attack graph-based industrial control system security measurement method according to claim 1, wherein in the first step, the obtained industrial control network topology structure information includes topology planning, system configuration and access control rules of security devices in a system design document; and reading and extracting the connection relation between the system devices according to the system design document and the access control rule of the safety device so as to restore the topological structure of the system.

3. The attack graph-based industrial control system security measurement method according to claim 1, wherein in the second step, collecting the device vulnerability information comprises building a vulnerability information base and obtaining a device vulnerability;

constructing a vulnerability information base, namely acquiring vulnerability information and processing the vulnerability information; the method comprises the steps that a security knowledge base is constructed by taking a CVE-NVD (composite video and video description) Vulnerability Database as a main body, taking a CNNVD (network video and video communication) and ICS (internet security and environment) Vulnerability Database as an expanded security base and taking a CWE (world wide web Environment) and CAPEC (computer-aided engineering) as Vulnerability association information bases, and collected Vulnerability information is stored into a MySQL (structured query language) Database; the vulnerability information processing takes a CNNVD (conditional network video and video express) and CVE (conditional virtual environment) vulnerability knowledge base as a main body, matches and associates all vulnerability information imported into a MySQL (MySQL query language) database, introduces CWE as a basis for vulnerability description, vulnerability classification and usability judgment, and combines CAPEC (computer aided engineering) to describe the premise, technical reserve, mode and consequences of attacking by utilizing vulnerabilities;

acquiring equipment vulnerabilities by adopting a scanning tool to scan the vulnerabilities of system equipment, and configuring the scanning tool according to the acquired system equipment information to complete scanning of equipment vulnerability information; then, according to the acquired equipment vulnerability information obtained by scanning, associating and representing equipment and vulnerabilities, wherein one piece of equipment can be associated with one or more vulnerabilities, the connection relationship between the equipment and the vulnerabilities is defined as has _ VUL _ at, and DEVICE1 has _ VUL _ at VUL1 indicates that the equipment 1 has the vulnerability with the number of VUL 1; and matching the equipment vulnerability information with information in a vulnerability information base, wherein each vulnerability can obtain an atomic attack template of CNNVD description-CVE vulnerability number-CWE vulnerability report-CAPEC attack method-CVSS score, and input data is provided for generation of a subsequent attack graph.

4. The industrial control system security measurement method based on the attack graph as claimed in claim 1, wherein in step three, the nodes in the attack graph include device nodes and vulnerability nodes;

the equipment node information comprises service information, open port information and IP information of the equipment vulnerability, the equipment node information is used as the attribute of the equipment node, and the equipment node information is described by adopting quintuple, namely equipment IP, equipment name, service with the vulnerability, service protocol and service port;

the vulnerability node information comprises CVE \ CNNVD number, CWE classification, authority-raising capability identification and CVSS score in the atomic attack rule, the vulnerability node information is integrated on a vulnerability node with a vulnerability ID as an identification as a node attribute, and the vulnerability node information is described by adopting four-tuple, namely vulnerability ID, vulnerability number, vulnerability type and vulnerability score;

and preprocessing the data according to the results of network topology analysis and vulnerability information collection, and summarizing the data into an equipment information table, a vulnerability information table and an equipment relation table which are used as the input of an attack graph generation algorithm.

5. The attack graph-based industrial control system security measurement method according to claim 1, wherein in step four, the vulnerability node measurement quantifies the availability of vulnerability nodes and vulnerability hazards according to the scanned device vulnerability information; the availability of the vulnerability nodes is defined by an 'attack possibility' field in a CAPEC library, the { low, medium and high } attack possibility is quantitatively expressed as {0.3, 0.6 and 0.9}, the low score represents the low possibility of attack, and the high score represents the high possibility of attack; and the damage score of the vulnerability node is the vulnerability assessment score of a CVSS (common security vulnerability assessment system), the full score is 10, the higher the score is, the greater the vulnerability damage is, the lower the score is, and the smaller the vulnerability damage is.

6. The attack graph-based industrial control system security measure method of claim 1, wherein in step four, the device node measures are quantified according to the device node attack probability and the device node risk score;

a. probability of attack on device node

Aiming at the vulnerability nodes connected with each equipment node, calculating the attacked probability of the equipment nodes according to the availability, as shown in formula I:

wherein, U_selfRepresenting the probability of attack, u, of the node of the device_iThe availability of the ith vulnerability node connected with the equipment node is represented, k represents the number of all vulnerability nodes connected with the equipment node, and the greater the number of vulnerability nodes connected with the equipment node is, the higher the attacked probability of the equipment node is;

b. equipment node risk score

And performing weighted hazard calculation on the vulnerability nodes according to the availability of the connected vulnerability nodes to obtain the risk score of the equipment node, as shown in formula II:

wherein R is_selfRepresenting the risk score, u, of the node of the plant_i、u_jRepresenting the availability, r, of the ith and j vulnerability nodes connected with the equipment node_iIndicating the vulnerability hazard of the ith vulnerability node connected with the equipment node.

7. The attack graph-based industrial control system security measure of claim 1 wherein in step four, the system security measures comprise an initial node measure and a non-initial node measure;

a. starting node metric

Since the starting node acquires the authority and has no attacked condition, the attacked probability of the starting device node is defaulted to 1 to represent that all the authority of the device is acquired, and since the starting node has no forward node and the degree of entry is 0, the danger score of the starting node is equal to the self danger score of the node;

b. non-starting node metric

The non-initial node considers the vulnerability node connected with the node, and simultaneously combines the attacked probability and the equipment danger score of the upper layer equipment node, calculates the accumulated attacked probability and the equipment danger score of the upper layer equipment node and the local layer equipment node, and calculates the system safety measurement according to the danger score of the multilayer accumulated equipment nodes;

the attack probability of the non-initial node is calculated as formula III:

wherein d is_iRepresents the node in degree, U_mRepresenting the attacked probability of the mth upper node connected with the equipment node; the measuring method considers the degree of the node and the influence of the attacked probability of the upper node on the node of the current layer, wherein the higher the degree of the node is, the higher the attacked probability of the node is; the higher the attack probability of the upper layer node is, the higher the node of the current layer isThe greater the attack probability;

the risk score for a non-starting node is calculated as formula iv:

wherein, U_m、U_nRepresenting the probability of attack, R, of the m, n upper level nodes connected to the device node_mA danger score representing an mth upper node connected to the equipment node;

the risk score of the non-initial node is calculated by considering the influence of the attack probability of the upper node on the node of the local layer, and meanwhile, the risk score of the upper node is calculated in an accumulated mode, and the greater the node degree of entry is, the greater the node risk score is; the higher the attack probability of the upper-layer node is, the higher the danger score of the node at the current layer is; the larger the danger score of the upper node is, the larger the danger score of the node at the current layer is, and the danger score R of the final target node is_destAnd performing cumulative calculation on the attack paths through multiple layers.

8. The attack graph-based industrial control system security measure method of claim 1, wherein in step four, the attack path comprises a nested path and a parallel path; carrying out quantitative analysis on the key attack path by combining with a system security measurement value, introducing an asset value index to measure in the analysis process, wherein the asset value is jointly determined by the access degree of a node and the asset importance, the asset importance index is divided into ten grades from 1 to 10 for assets, 10 is very important, and 1 is very unimportant; meanwhile, according to the access degrees of the nodes appearing in the current attack graph, the highest access degree is taken as the standard, normalization processing is carried out on the rest access degrees, the access degrees of the initial node and the target node are defaulted to be 1, no weight reduction processing is carried out, and finally the asset value is obtained by the product of the asset importance and the access degree, wherein the formula is V:

P_value＝P_significance*d_io (Ⅴ)

wherein, P_valueRepresenting asset value, P_significancePresentation assetImportance of birth, d_ioRepresenting the node access degree after normalization processing;

a. nested path analysis

Nodes in the path set of the nested paths do not include a common starting node, and the key path in the case is selected as follows:

wherein, Path_signIs a path critical index, U_jRepresenting the probability of being attacked, R, of the jth device node in the path set_iRepresenting the danger score, P, of the ith device node in the path set_valueiRepresenting the asset value of the ith equipment node in the path set; the key path of the nested path takes attack hop count as a main calculation basis, the path with less attack hop count is the key path under general conditions, and the path with more attack hop count can be the key path only when the attack rate and the danger score of the intermediate hop node are both larger;

b. parallel path analysis

The path set of the parallel attack path is represented by N parallel nodes excluding the common start node and the common end node, and the key path in this case is selected and calculated as follows:

Path_sign＝max{U_i*R_i*P_valuei} i＝(1，2，...k) (Ⅶ)

U_irepresenting the probability of attack, R, of the ith device node in the path set_iRepresenting the danger score, P, of the ith device node in the path set_valueiRepresenting the asset value of the ith equipment node in the path set; finally, the selection of the key path is obtained by comparing the key indexes of the N parallel paths;

and synthesizing the analysis results of the nested path and the parallel path, and calculating the importance of the multiple paths through the quantitative indexes to obtain the key attack path.

9. A server, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

when executed by the one or more processors, cause the one or more processors to implement the attack graph-based industrial control system security measure method of any one of claims 1-8.

10. A computer-readable medium, on which a computer program is stored, wherein the computer program, when executed by a processor, implements the attack graph-based industrial control system security measure method of any one of claims 1 to 8.

Images