A Same-origin Attack Analysis Method for Industrial Control Honeypots

Abstract

The invention discloses an industrial control honeypot-oriented homologous attack analysis method, which introduces coarse-grained and fine-grained attack behavior features through the attacker's physical location characteristics, and converts attacker information into a set of multi-dimensional attack behavior feature vectors. Use the Canopy method to find the optimal K value based on the attacker’s coarse-grained attack information, and then use the improved K-means clustering method based on the attacker’s fine-grained attack information to determine the attackers or attacking organizations with similar European distances as homologous attacks . Through the present invention, the behavior characteristics of homologous attackers can be modeled as feature vectors based on function code sequences, which is applicable to the analysis of honeypot data of many industrial control protocols with function code characteristics; it is difficult to determine and verify the same attack source of honeypot data Provide a verification method for the problem. For some unknown enterprise scanners or attackers, use the open source abuse IP database query, and verify the traditional attacker information of other unknown attackers.

Description

technical field [0001] The invention belongs to the field of industrial control security, and relates to industrial control honeypot data analysis, in particular to an industrial control honeypot-oriented homologous attack analysis method. Background technique [0002] The research on attacker traceability mainly relies on IP traceability technology, which is a key means of active protection of network security. The mainstream methods include: probabilistic packet marking traceability method and log traceability method. The probabilistic packet marking technology writes identification information (such as IP address) into the header field (marking field) of the forwarded packet, and then the victim retrieves the marking information from the received packet and finally determines the attack path. The log tracing method is that the router records the information related to the packet before forwarding the packet, and then reconstructs the attack path based on the recorded info...

AI Technical Summary

Problems solved by technology

However, these same-origin attack judgment methods can only complete the attack data of specific modified honeypots. The specific methods and principles are not applicable to industrial control honeypots, nor can they find out the same-origin attackers or attacking organizations targeting industrial control honeypots.

Images