Homologous attack analysis method for industrial control honeypot

Abstract

The invention discloses a homologous attack analysis method for an industrial control honeypot, and the method comprises the steps: introducing coarse-grained and fine-grained attack behavior featuresthrough the physical position features of an attacker, converting the information of the attacker into a group of multi-dimensional attack behavior feature vectors, finding an optimal K value by using a Canopy method according to the coarse-grained attack information of the attacker, and determining attackers or attack organizations with close Euclidean distances as homologous attacks by using animproved K-means clustering method according to the fine-grained attack information of the attacker. According to the method and the system, the behavior characteristics of the homologous attacker can be modeled into the characteristic vector based on the function code sequence, and the method and the system are suitable for analyzing various industrial control protocol honeypot data with function code characteristics; a verification method is provided for solving the problem that it is difficult to judge and verify the same attack source of honeypot data, for some unknown enterprise scannersor attackers, an open source abuse IP database is used for query, and the traditional attacker information of the other unknown attackers is verified.

Description

technical field [0001] The invention belongs to the field of industrial control security, and relates to industrial control honeypot data analysis, in particular to an industrial control honeypot-oriented homologous attack analysis method. Background technique [0002] The research on attacker traceability mainly relies on IP traceability technology, which is a key means of active protection of network security. The mainstream methods include: probabilistic packet marking traceability method and log traceability method. The probabilistic packet marking technology writes identification information (such as IP address) into the header field (marking field) of the forwarded packet, and then the victim retrieves the marking information from the received packet and finally determines the attack path. The log tracing method is that the router records the information related to the packet before forwarding the packet, and then reconstructs the attack path based on the recorded info...

AI Technical Summary

Problems solved by technology

However, these same-origin attack judgment methods can only complete the attack data of specific modified honeypots. The specific methods and principles are not applicable to industrial control honeypots, nor can they find out the same-origin attackers or attacking organizations targeting industrial control honeypots.

Images