Industrial control network-oriented Quantitative evaluation method and system for influence of multi-mode attack mode on state of industrial control system

Abstract

The invention relates to an industrial control network-oriented quantitative evaluation method and system for influence of a multi-mode attack mode on a state of an industrial control system, and the method comprises the following steps: (1) carrying out the preliminary description and extraction of a state feature, i.e., a state data set of the industrial control system, and obtaining a state data segmentation point; (2) clustering the state features; (3) constructing a state transition probability graph; and (4) carrying out quantitative evaluation on the influence of the system state based on the abnormal characteristics and the damage degree index. According to the method and system, for various industrial control network attack strategies, the state abnormal characteristics are taken as main indexes, the actual state change of the system in the attack proceeding stage and the attack ending stage is quantitatively evaluated, and the problem that the influence of various attack strategies on the system state is difficult to accurately evaluate is solved. According to the method and system, a formula for evaluating the influence of the attack strategy on the system state is provided, state abnormal characteristics and threat damage degrees are associated, evaluated and analyzed, and an evaluation result consistent with the actual state influence is obtained.

Description

technical field [0001] The invention relates to a method and system for quantitatively evaluating the influence of an industrial control network-oriented multi-mode attack mode on the state of an industrial control system, and belongs to the technical field of information security. Background technique [0002] Components such as engineer station, human-machine interface (HMI), control equipment, sensors, and controlled equipment in the industrial control network, as well as the communication network between them, all have the possibility of being attacked. Scholars started early in the research work on the impact of physical attacks, man-in-the-middle attacks, denial-of-service attacks, and covert attacks on industrial control networks. In 2009, Yu established a method to describe the attack threat model. Using the attack of the command u and the attack of the sensor parameter y, the way of performing denial of service attack and man-in-the-middle attack is verified by anal...

AI Technical Summary

Problems solved by technology

[0004] The research on attack impact assessment has important theoretical value and practical significance for identifying attack intentions. The research work of the above scholars has promoted the development of equipment state impact analysis under semantic attacks, but the research in the specific security attack and defense shooting range environment is still relatively rare. See

[0005] However, under the attack of the industrial control network, the equipment is in multiple stages of "normal operation → attack → attack end", and the characteristics of state changes in each stage are diverse. The existing research on the impact of attacks lacks the understanding of the various stages of the system under different attack strategies. Evaluation and analysis of state characteristic changes

In the existing research on the impact of semantic attacks, there is a lack of evaluation and analysis of the relationship between abnormal state characteristics and threat damage

Images