Automatic vulnerability detection plugin generation method and system for industrial control system

Abstract

The invention discloses an automatic vulnerability detection plugin generation method and system for an industrial control system. A current industrial control system vulnerability mining technology Fuzzing can find vulnerability but can not perform further processing on a vulnerability plugin. The method disclosed by the invention comprises a Fuzzing test link, a vulnerability playback link and avulnerability collecting link, the Fuzzing test link comprises the following sequential steps: constructing data sources and performing data storage; acquiring the data sources, starting to perform Fuzzing scanning, and mining vulnerability; monitoring a mining process; if all the data sources are completely polled and no problem is triggered, finishing the mining process; if a problem is triggered, acquiring node IDs of the data sources, and entering the vulnerability playback link; and the vulnerability playback link comprises the following sequential steps: generating the data sources andacquiring node information; acquiring the data sources, and starting to perform the Fuzzing scanning; and if no problem exists after verification, finishing, and if a problem exists, entering the vulnerability collecting link. The method disclosed by the invention can automatically generate a vulnerability detection plugin, converts unknown vulnerability into known vulnerability and improves vulnerability mining efficiency.

Description

technical field [0001] The invention relates to the field of industrial control systems, in particular to a method and system for generating an automatic loophole detection plug-in for an industrial control system. Background technique [0002] In an industrial control system, whether it is a primary system or a secondary system, as well as a bay layer or a process layer, business continuity and health are crucial, especially for the core monitoring of petrochemical, electric power, transportation, nuclear industry, water conservancy and other industries ,production system. However, due to its long-term closed and independent characteristics, the industrial control system has caused a lack of security construction, and does not have more fault-tolerant processing, such as the processing of abnormal instructions, and does not have high-pressure processing, such as fast data transmission and access. Wait. [0003] In the face of new industrial control security threats, super...

AI Technical Summary

Problems solved by technology

[0007] 1) A single Fuzzing takes a long time, and the problem verification time is uncontrollable;

[0008] 2) A comprehensive fuzzing test on the target system may take tens of minutes or even ten hours;

[0009] 3) The scanning problem may be affected by other uncertain factors. If you want to reproduce the problem, it is difficult to control the time and problem points from the beginning;

[0010] 4) When verifying the same type of different devices with identified problems, Fuzzing again will take time and effort;

[0011] 5) Vulnerability detection can only trigger verification and cannot effectively use POC;

[0012] 6) When non-destructive scanning verification is performed on different devices of the same type with identified problems, there is a lack of powerful POC

Images