System and method for evaluating the impact of software on industrial automation and control systems

Abstract

The present invention relates to systems and methods for evaluating the impact of software on components of an industrial automation and control system (IACS). In one aspect, an exemplary method includes: selecting a sample of software to be analyzed for the ability to cause damage to the IACS; for each specific configuration of the IACS being tested, performing analysis to identify the impact of the selected sample on the specific configuration, wherein the identified impact includes at least causes and events that lead to interruptions in operation of the specific configuration of the IACS, the specific configuration including at least components of the industrial system being simulated on the test device; analyzing all identified causes and events; and based on the analysis, evaluating the impact of the selected sample by determining the extent of the impact of the software on the specific configuration.

Description

Technical Field

[0001] The present invention relates to the field of industrial automation and control systems, and more specifically, to systems and methods for evaluating the impact of software (e.g., software being studied) on industrial automation and control systems (e.g., automated control systems). For example, the impact of software (e.g., malware) can be studied to identify and mitigate vulnerabilities that affect the availability of industrial automation and control systems. Background Art

[0002] Currently, various malicious actors are observed to be interested in critical infrastructure objects. Critical infrastructure objects may include objects in the industrial field, such as objects used for power supply, water supply, oil and gas industry, automotive industry, and automation systems for buildings, data storage and data transmission. These objects contain various industrial automation systems, such as Industrial Control System (ICS) or Industrial Automation and Control Systems (IACS). ICS may in turn contain monitoring systems. An example of an industrial monitoring system is the Automated Control System for Technological Processes (ACS TP).

[0003] Compared with traditional cyber threat handling, ICS security assurance involves specific processes with many differences. Cyber ​​threats are a collection of various factors and conditions that pose a risk of compromising information security. In particular, ICS protection strategies involve ways to preserve the operational capabilities of technical processes. In contrast, in corporate systems, it is more important to maintain the confidentiality and availability of data.

[0004] A large number of threats to industrial systems and their respective ICS and IT systems involve ordinary malware, i.e., software that is not designed for targeted cyberattacks. In this context, “ordinary malware” refers to malware that was not developed specifically for attacks on industrial systems. Even so, as experience has shown, these malware may affect the integrity and availability of individual components of the ICS, although they have little impact on the work of IT systems, and therefore, they may indirectly affect the stability of technical and manufacturing processes. For example, malicious programs such as crypto-malware and programs whose goal is to destroy files in computer hard drives (file wipers) can have a devastating technical impact on ICS and IT systems of various technical systems.

[0005] In another example, a miner (a program used to mine cryptocurrency by utilizing large amounts of computing resources) is considered relatively harmless in an office network. However, during the operation and spread of the miner, its mining activity could cause a denial of service for certain components of the ICS.

[0006] In another example, network worms (various malicious programs) pose a great danger to both IT systems and technical networks, and the consequences of their actions can be more serious than those of miners. For example, network worms found on many computers of ICS are known to have spread through network folders, removable media, and local (LAN) and global networks (WAN) using network vulnerabilities, and destroyed data on infected devices. In many cases, such actions of network worms can lead to denial of service of ICS, especially for monitoring and remote control systems. In addition, network worms can also lead to emergency situations.

[0007] In another example, multi-purpose spyware is software that is often capable of stealing confidential information, downloading and running other malware, and causing further damage by providing other malicious actors with the possibility of unauthorized remote control of the infected device. These programs are also called backdoor programs.

[0008] The consequences of the activities of such malware programs on computers depend on the importance of the attacked technical system for the production and business processes of the enterprise. In many cases, such malware programs have a disproportionately severe impact on ICS. This impact is mainly due to the specific architecture and intrusion in ICS systems. Therefore, malware that may not have a significant negative impact on the IT systems of an enterprise may still have serious consequences for the enterprise. For example, malware may cause system downtime in an industrial network and interrupt production processes.

[0009] It should also be noted that not only malware can have a significant negative impact on ICS, especially automated control systems, but also legitimate software containing errors can lead to unexplained behavior and disruption of the work of ICS.

[0010] In addition, the security of industrial systems against external computer threats is a pressing issue in itself. In particular, it is necessary to control and ensure the security of industrial controllers (programmable logic controllers) and automation control systems.

[0011] At the same time, in order to create the necessary level of protection against threats, it is necessary to conduct a preliminary assessment of the risks of industrial systems, so as to be able to consider external actions on various elements of industrial systems (such as PLC, SCADA, SiS) based on common software and / or malicious software.

[0012] An example of a threat is an attack on the elements of an industrial system during which these elements are notified of a denial of service. The usual strategy involves testing each individual device of the ICS in each configuration. This often creates problems because the usual strategy requires the purchase of the ICS devices and the need to place the ICS devices in place, which can be an expensive affair. In addition, how a specific element will behave in the industrial network (which in most cases will be unique to a specific industrial object) is also unknown.

[0013] Therefore, there is a need for a method for determining (i.e., predetermining) the occurrence conditions of denial of service of industrial systems and their ICS elements (components) caused by indirect actions of malware. In other words, it is necessary to determine the impact of malware on industrial automation and control systems before an attack. Summary of the invention

[0014] Aspects of the present invention relate to evaluating the impact of software on industrial automation and control systems, for example, the impact of software being studied on an industrial automation system.

[0015] In one exemplary aspect, a method for evaluating the impact of software on industrial automation and control systems is provided, the method comprising: selecting a sample of software to be analyzed for its potential ability to cause damage to an industrial automation and control system (IACS); for each specific configuration of the IACS being tested, performing analysis to identify the impact of the selected sample of software on the specific configuration of the IACS, wherein the identified impact includes at least causes and events that lead to operational interruptions of the specific configuration of the IACS, the specific configuration including at least components of an industrial system being simulated on a test device, wherein the testing includes: monitoring requests and responses between components of the specific configuration; analyzing all identified causes and events that lead to operational interruptions of the specific configuration of the IACS; and based on the analysis, evaluating the impact of the selected sample of software by determining the extent of the impact of the software on the specific configuration of the IACS.

[0016] In one aspect, performing analysis to identify the impact of the selected samples also includes collecting data, the data including at least one of the following: the time to send a request from one component of the particular configuration to another component, the time to respond to a request from a component of the particular configuration, and the latency time for a component to react to a command acting on the particular configuration of the IACS.

[0017] In one aspect, the reasons for interrupting the operation of the specific configuration of the IACS include at least one of the following items: the time to send a request exceeds a first predetermined threshold, the time to respond to a request exceeds a second predetermined threshold, and the delay time to react exceeds a third predetermined threshold.

[0018] In one aspect, the selection of the sample of software is performed using any number of criteria indicating an impact that represents a threat to at least one of: availability, operational capability, and integrity of the particular configuration of the IACS.

[0019] On the one hand, the selection of samples of software is performed by: launching and running each sample of the software in an isolated environment of a sandbox; generating an event log during the running in the sandbox, wherein the generated event log contains all activities that occurred during the running; and based on the analysis of the generated event log, selecting a suitable sample of the software to be studied for testing on a test device.

[0020] In one aspect, the method further comprises, for each specific configuration of the IACS being tested, generating recommendations based on an assessment of the impact of a selected sample of software, the recommendations comprising at least one of: a recommendation to initiate detection of indicators of infection by a sample of the software, a recommendation to prevent infection by a selected sample of the software, a recommendation to delete a sample of the software and remove the consequences of infection by a sample of the software, a recommendation to correct components of a specific configuration affected by a sample of the software, and a recommendation to perform additional testing.

[0021] In one aspect, the analysis for identifying the impact of the selected samples includes performing at least one test intended to collect data regarding the impact of the selected software on the configuration of the IACS being tested and being simulated on the test device.

[0022] In one aspect, the method further comprises generating a configuration of the IACS on the test device according to a received specification for testing, wherein the specification comprises information about at least one of: components of the IACS, functional performance of components of the IACS, interactions occurring between components of the IACS, and information about data exchanged between components of the IACS.

[0023] In one aspect, the sample of software is selected based on at least one of: a type of industrial system, a component of the industrial system, a component of a configuration of the IACS being tested.

[0024] In one aspect, the analysis for identifying the impact of the selected samples is performed in an automated manner.

[0025] In one aspect, the method further comprises, for each specific configuration of the IACS being tested, performing an assessment of the impact of the selected samples by determining a probability of degradation of computing resources of the specific configuration of the IACS.

[0026] According to one aspect of the present invention, a system for evaluating the impact of software on industrial automation and control systems is provided, the system comprising a hardware processor configured to: select a sample of software to be analyzed for its potential ability to cause damage to an industrial automation and control system (IACS); for each specific configuration of the IACS being tested, perform analysis to identify the impact of the selected sample of software on the specific configuration of the IACS, wherein the identified impact includes at least causes and events that lead to operational interruptions of the specific configuration of the IACS, the specific configuration including at least components of an industrial system being simulated on a test device, wherein the test includes: monitoring requests and responses between components of the specific configuration; analyzing all identified causes and events that lead to operational interruptions of the specific configuration of the IACS; and based on the analysis, evaluating the impact of the selected sample of software by determining the extent of the impact of the software on the specific configuration of the IACS.

[0027] In one exemplary aspect, a non-transitory computer-readable medium is provided on which is stored a set of instructions for evaluating the impact of software on an industrial automation and control system, wherein the set of instructions includes instructions for the following operations: selecting a sample of software to be analyzed for its potential ability to cause damage to an industrial automation and control system (IACS); for each specific configuration of the IACS being tested, performing analysis to identify the impact of the selected sample of software on the specific configuration of the IACS, wherein the identified impact includes at least causes and events that lead to operational interruptions of the specific configuration of the IACS, the specific configuration including at least components of an industrial system being simulated on a test device, wherein the testing includes: monitoring requests and responses between components of the specific configuration; analyzing all identified causes and events that lead to operational interruptions of the specific configuration of the IACS; and based on the analysis, evaluating the impact of the selected sample of software by determining the extent of the impact of the software on the specific configuration of the IACS.

[0028] The method and system of the present invention are designed to evaluate the impact of software (e.g., malware being studied) on industrial automation systems. For example, the impact on availability is evaluated. The method of the present invention solves the above shortcomings and reveals the vulnerability points of various industrial automation and control systems (e.g., industrial control systems (ICS)) based on the evaluation of the impact of various software such as malware on the operational capability or availability of industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more exemplary aspects of the present invention and, together with the detailed description, serve to explain the principles and implementations of these exemplary aspects.

[0030] Figure 1 An example of the architecture of an industrial infrastructure for implementing the method of the present invention is shown.

[0031] Figure 2 A system for evaluating the impact of software on the operation of a particular configuration of infrastructure of an IACS (eg, on an ICS) in accordance with the teachings of the present invention is shown.

[0032] Figure 3 An exemplary test device according to the invention is shown, which is designed to simulate a specific configuration of an IACS, in particular an ICS.

[0033] Figure 4 An exemplary scenario of the impact of malware on an ICS during which a denial of service occurs is shown in accordance with the present invention.

[0034] Figure 5 A block diagram illustrating an exemplary method of assessing the impact of software on a component of an industrial system in accordance with the present invention is shown.

[0035] Figure 6 A block diagram illustrating a specific example of a method for assessing the impact of malware in accordance with the present invention is shown.

[0036] Figure 7 An example of a general purpose computer system is shown upon which aspects of the invention may be implemented. DETAILED DESCRIPTION

[0037] Exemplary aspects are described herein in the context of systems, methods, and computer programs for evaluating the impact of software on industrial automation and control systems (e.g., studying the impact of software on industrial automation systems). One of ordinary skill in the art will recognize that the following description is illustrative only and is not intended to be limiting in any way. Other aspects will readily suggest themselves to one of ordinary skill in the art who understands the advantages of the present invention. Reference will now be made in detail to the implementation of exemplary aspects as shown in the accompanying drawings. The same reference numerals will be used as much as possible throughout the drawings and the following description to refer to the same or similar items.

[0038] In one aspect, the present invention describes a system for evaluating the impact of software on industrial automation and control systems (e.g., the impact of the software being studied on the industrial automation system), which is implemented on a computing system and includes real-world devices, systems, components, and component groups, which are implemented using hardware such as integrated microcircuits (application-specific integrated circuits, ASICs) or field-programmable gate arrays (FPGAs), or, for example, in the form of a combination of software and hardware (e.g., a microprocessor system and a program instruction set), and are also implemented on a neurosynaptic chip. The functions of these modules of the system can be implemented solely by hardware, and can also be implemented in a combined form, where some functions of the system modules are implemented by software and some functions are implemented by hardware. In some aspects, some or all of the components, systems, etc. can be implemented on a general-purpose computer (such as a Figure 7 In addition, the system components may be implemented in a single computing device, or may be distributed among multiple interconnected computing devices.

[0039] The present invention enables at least an assessment of the impact of malware on the operation of a particular configuration of an industrial automation and control system (IACS). In one aspect, in performing at least one assessment, the systems and methods of the present invention implement at least one of the following actions:

[0040] Analyze malware in a sandbox-type simulation environment and then identify suitable malware to test specific configurations of IACS, especially ICS,

[0041] Conduct controlled testing of malware samples in simulated environments with specific configurations of IACS, especially ICS,

[0042] Identify and measure the impact of each sample of malware on a specific configuration of IACS, especially ICS,

[0043] Analyze all identified causes (events) that led to interruptions in the specific configuration operation of the IACS, and

[0044] Announce a verdict on the dangerousness of a specific sample of specific malware in a specific configuration of IACS.

[0045] In other aspects of the invention, the method comprises generating a corresponding report containing compromise indicators obtained due to malicious activity of at least one sample of malware, wherein the compromise indicators at least indicate the cause or event of one or another interruption affecting the operation of the IACS. In addition, the method of the invention also enables the assessment of the impact of legitimate software on the operation of a specific configuration of the IACS.

[0046] The method of the present invention has several advantages. The first advantage is to broaden the range of technical means for evaluating the impact of software (e.g., the malware being studied) on the working ability of a specific configuration of an industrial automation system. A second advantage of the present invention is to identify vulnerabilities of various industrial automation systems. A third advantage of the present invention is to identify, classify and notify malware that has a significant impact on a specific configuration of a specific system of an IACS, especially an ICS.

[0047] The method and system of the present invention make it possible to at least evaluate the impact of software (the software being analyzed / studied) on the operation (working capacity) of a specific infrastructure configuration of an Industrial Automation and Control System (IACS). IACS refers mainly to various Industrial Control Systems (ICS) that are integrated together in an industrial information and communication network. And an example of an ICS is an automatic control system for technical processes (ACS TP) and its components. An ICS is a set of hardware and software solutions designed to automate the control of technical equipment in an industrial enterprise. Examples of components of an ICS are: Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Safety Instrumented Systems (SiS), systems based on Programmable Logic Controllers (PLC), data gateways, Open Platform Communications (OPC) and network devices that integrate the above systems into the technical network, etc.

[0048] In the context of the present invention, "studied software" refers primarily to malware, but not exclusively. Thus, studied software may also be software that is capable of damaging the operation of the IACS. Examples of such studied software are:

[0049] Legitimate software that is incompatible or only partially compatible with IACS or its components,

[0050] Legitimate software that contains bugs that cause unexplained behavior of IACS or its components,

[0051] Dedicated (certified) software that has been modernized or has had a new version released,

[0052] Uncertified software, which is generally legitimate and designed to be used directly in the operation of components of IACS, and

[0053] Untrusted software whose actions could cause a denial of service of a component of the IACS or lead to an emergency situation.

[0054] Thus, the method of the invention allows detecting any anomalies in the operation of the studied software and enables evaluating the impact of the studied software with respect to its compatibility or incompatibility with target software in industrial systems and networks. It should also be noted that malware includes non-targeted malware. Non-targeted malware is malware that was not initially created to directly cause any damage to industrial systems and networks. Most likely, the impact and damage caused by non-targeted malware are side effects or even the result of errors in the development of such software.

[0055] The method of the present invention has the following functional capabilities for evaluating the impact of the software under investigation on the operational capabilities of systems such as ICS and similar systems:

[0056] 1) Automatically analyze the functionality and behavior of computer programs detected both in user personal computers and in the network, and then identify the types and actual samples of the software under investigation that may be able to cause damage to ICS systems.

[0057] 2) During the screening process described in item 1), at least one automated study is performed on the test equipment to simulate a specific configuration of the ICS or several different ICSs for at least one software under study. During the study, the impact of the software is evaluated when the software is run on the test equipment in the presented configuration of the ICS according to various parameters, including parameters for measuring productivity and / or temporary failures of the ICS and its components or objects controlled by the ICS.

[0058] 3) Categorize the software under study (especially malware) according to its impact on ICS, and determine the indicators of compromise and artifacts resulting from the analysis of the impact of the software under study on ICS, so as to create signatures or behavioral rules to be able to detect the following indicators, which can be subsequently used to discover the infection of ICS by the corresponding software.

[0059] 4) Make a decision about immediately conducting additional research or taking possible measures to protect against the influence of the studied (malicious) software in the ICS system and in the information and communication networks through which the ICS is linked to other devices or systems of the industrial object.

[0060] Some advantages of the present invention over other approaches are the ability to:

[0061] Detection and subsequent classification of software, including malware, that has a significant impact on specific configurations of ICS;

[0062] Detect vulnerabilities in specific ICS configurations and subsequently generate appropriate reports; and

[0063] Creating a test device that simulates a specific configuration of the ICS infrastructure or the entire ICS and then testing a sample of the software under investigation on the test device.

[0064] Figure 1 An example of the architecture of an industrial infrastructure 100 is shown, for which the method of the present invention is implemented. The industrial infrastructure 100 can have five different interactive network layers. The first network layer is the field layer, which includes many industrial (field) devices in use. Examples of field devices are sensors, valves, transducers, actuators (such as pumps, lasers or machine tools), and other devices. The second network layer is the technical network, which includes various industrial controllers, especially programmable logic controllers (PLCs). The controller provides control of the field devices and interacts with the components of the third network layer. The third network layer is the control layer (distributed computer network), which includes workstations (computers), servers, and network devices. The workstations can contain industrial control systems (ICS), such as technical process automation control systems (ACSTP) or SCADA. Servers can perform computing, control, and monitoring functions. The fourth layer is the enterprise layer (office network), which typically includes personal workstations and servers of employees of industrial enterprises. The fifth network layer is a layer that interacts with basic devices outside the enterprise, which can be connected to the basic devices via information and communication networks (such as the Internet).

[0065] Examples of industrial automation and control systems (IACS) may include one or more industrial controllers that help monitor and control corresponding industrial equipment and processes. Industrial controllers such as PLCs can integrate the technical network and the control layer network by means of built-in wired input / output (I / O) networks and / or by exchanging data with field devices through a factory network. Industrial controllers can typically receive any given combination of digital or analog signals from field devices that can display the current status of industrial equipment and / or industrial processes associated therewith (e.g., temperature, position, presence of components, liquid level, etc.), and can run a control program determined in advance by a user that can make automated decisions on the industrial process being monitored based on the received signals. Such a control program is also referred to as target software. The industrial controller can output corresponding digital and / or analog control signals to the field device based on the decisions made by the control program. The output can include signals for controlling equipment, signals for controlling temperature or position, work commands for robots for handling or moving materials, signals for controlling agitators, signals for controlling motion, etc. The control program may include any suitable type of code that may be used to process input signals read into the controller and control output signals generated by the industrial controller, including, among others, ladder logic, function diagrams, function block diagrams, structured text or other similar platforms.

[0066] Figure 2 A system 200 is shown for evaluating the impact of software on the operation of a specific configuration of an infrastructure of an IACS (e.g., on an ICS) in accordance with the teachings of the present invention. The infrastructure configuration of an IACS is generated based on a combination of specific components or devices, such as Figure 1 As shown, these specific components or devices make up the architecture of the industrial infrastructure 100.

[0067] When checking the operation of the ICS, first check for signs of the working capability of the ICS, such as detecting a denial of service of at least one component of the ICS or the ICS itself. A system 200 for evaluating the impact of software under investigation on the operation of the ICS (hereinafter referred to as evaluation system 200) functionally includes at least a test device 210, a software selector 220, an availability monitor 230, and an impact assessor 240 (a device for evaluating the impact of the software under investigation). Figure 2 The composition of the system 200 presented in corresponds to the functional presentation of the system 200 for assessing impact, wherein the implementation of the various components may vary. The various components of the system 200 for assessing impact may be implemented together on the same device or on separate devices, such as on the same computer or on separate computers. For example, the software selector 220, the availability monitor 230, and the impact assessor 240 may be integrated within the test device 210 (i.e., within the same computer). In another example, the software selector 220, the availability monitor 230, and the impact assessor 240 may be implemented on separate computers. Figure 7 An exemplary computer for implementing system 200 is presented in FIG.

[0068] The test device 210 is configured to perform a test of a specific configuration of the ICS obtained or generated according to the specification using at least one sample of the software under investigation obtained from the software selector 220. During the test, data exchange occurs between the ICS components. In order to perform the test, the test device 210 makes it possible to repeat certain configurations of the ICS according to the simulation through at least one control program. The creation of the test device 210 simulating a specific configuration of the ICS can be done using actual components of the ICS or using virtual components of the ICS. The implementation will depend on various aspects of the test device 210 itself. When virtual components are used, accordingly, the test device 210 will also be virtual and implemented on a computing device using corresponding technologies such as virtualization and simulation.

[0069] When the test device 210 is implemented by means of hardware (device), the components for simulating a specific configuration of the ICS are selected according to the obtained specifications of the ICS and the functional performance of the components. According to the functional performance, a corresponding information exchange of data will occur between the components during the test. For example, the configuration of the ICS is a technical network that integrates at least one controller PLC and at least one SCADA system. The SCADA system and the PLC controller are located on different computers (devices). The computer with the SCADA system (K1 in the following example) will exchange data with each computer of the PLC controller (K2 in the following example). Therefore, K1 requests information about the status and operating mode of the device from K2 every second, and the device is controlled by the corresponding PLC controller.

[0070] The initial preparation of the test device 210, specifically, the formation of a specific configuration of the ICS for evaluation, is performed with the aid of an operator (e.g., a user) of the test device 210, or is performed automatically. When the preparation of the test device 210 is performed in an automated manner, the test device 210 has already constituted a technical network that integrates many different components of the ICS. A large number of different components of the ICS are integrated together in at least one common information and communication network (hereinafter referred to as the network). When the specification of the ICS is generated, certain components on the test device 210 will be turned on or off until such time that a specific configuration of the ICS has been formed according to the specification. It should be noted that the formation of the specific configuration of the ICS on the test device 210 can generally be based on a replication of an existing technical network used for testing.

[0071] In other words, the test device 210 is capable of monitoring, controlling and analyzing so that the impact of a sample of software under investigation, in particular malware, on the operation of a specific configuration of the IACS can be determined. The determination of the impact is performed by means of at least one availability monitor 230 and an impact assessor 240, wherein the test device 210 obtains the specification of the specific configuration of the IACS and at least one sample of a software under investigation from the software selector 220.

[0072] The software selector 220 is designed to generate a set of samples of the software under investigation to send the generated set of samples to the test device 210 and / or the availability monitor 230, the set of samples including at least one sample of the software under investigation. The selection of the software samples of the set is based on a controlled study of the execution of the software under investigation, and then an event log is generated and analyzed to identify impacts representing potential threats to the configuration of the ICS, the impact including at least one of the following items: availability, working ability or integrity of components of the ICS. Availability refers to the existence of access to the configuration of the ICS or its components, that is, there is no denial of service. That is, availability indicates whether there is a denial of service in terms of access to the configuration of the ICS or its components.

[0073] On the one hand, the generation of the set of samples is performed as follows. First, the software selector 220 obtains samples of malware from an external network. On the one hand, the external network is the Internet. It should be noted that there are a large number of malware. Therefore, according to this aspect of the invention, the software selector 220 obtains the most popular samples of malware and samples that represent the greatest threat. On the one hand, the greatest threat is characterized by a high risk of causing harm. On the other hand, the limiting criterion when selecting samples of malware is the popularity of malware, for example, the most popular malware is obtained for a specific type of device or device and a specific configuration of the IACS. These devices use different platforms during operation, such as x86 and ARM. The samples of malware obtained are studied with the help of sandbox technology. Sandbox technology refers to a technology that is in a special isolated (isolated) environment on a computer in order to safely run computer programs. An example of such an environment is a virtual machine. The sandbox is implemented in the software selector 220, which can in turn be implemented with the help of Figure 7 According to this aspect of the invention, the sandbox may constitute a standard environment (e.g., an environment emulating a personal computer) or a specific environment, wherein the details of the environment relate to the presence of SCADA components and / or processes running in the environment, files on disk, registration keys, and network ports specific to the technical network.

[0074] During the analysis, an event log is generated for each malware, which contains all activities that occurred during the execution of the malware in the isolated environment. Based on the analysis of the activity log of each malware, the software selector 220 selects the appropriate malware to be tested on the test device 210. Therefore, as described above, the selection of samples is based on a plurality of indicators that characterize (indicate) actions that represent a threat to the availability or working ability, and integrity, of a particular configuration of the ICS. Examples of such indicators include at least indicators for:

[0075] Manipulation of the memory of other processes occurs, where the manipulation involves read or write operators;

[0076] A large amount of memory is allocated, for example, equal to or greater than 1Gb;

[0077] A set of operations related to the file being performed (reading / writing of the file), where the set of operations includes two or more operations depending on the specific file;

[0078] Manipulation of system settings that occur, such as those in configuration files and / or the registry;

[0079] Manipulation of system files that occurs, such as writing to system files;

[0080] a set of operations that occur in conjunction with a registry, wherein the set of operations involves writing to the registry, and the set of operations includes two or more operations;

[0081] The loading of the driver occurred; and

[0082] Manipulation of processes that occur where these processes run in a sandbox and are specific to the technology network.

[0083] After identifying at least one of the selection criteria during the analysis of the event log, the software selector 220 makes a determination that the sample of malware is suitable for subsequent testing on the test device 210. Therein, the test device 210 simulates a specific configuration of the ICS. In this case, the sample of malware is included in the set of samples of the software under investigation to be sent to the test device 210. This selection of the software under investigation then enables testing of the specific configuration of the ICS in a more personalized manner.

[0084] The availability monitor 230 is adapted to monitor automated testing performed on a specific configuration of an ICS simulated on the test device 210. During such testing, the availability monitor 230 identifies the impact that each sample of the software under investigation has on access to each component contained in the ICS under test, or on the specific configuration of the ICS as a whole. In addition, in one aspect, the availability monitor 230 also has functionality capable of measuring the level / extent of the identified impact. In one aspect, the level of the identified impact can be measured using one or more probabilistic and deterministic measurement techniques. In one aspect, the measurement of the level of the identified impact is based on a previously generated scale.

[0085] In one aspect, the availability monitor 230 may include a server or router that performs the information exchange of certain data between the components of the ICS and records the parameters of the appropriate metrics for the ICS being tested. In this case, the data exchange is performed with the aid of "mirror ports" or mirroring, i.e., packets from one port of a network switch are copied to another port. The metrics are determined based on the configuration of the ICS. A complete list of metrics that the availability monitor 230 can measure / record is stored in a database ( Figure 2 (not shown).

[0086] On the other hand, the testing on the test device 210 is performed by the availability monitor 230. In order to perform the testing, the availability monitor 230 obtains a set of samples of the software under study from the software selector 220. Next, the availability monitor 230 generates a series of automated tests based on the number of samples of the software under study in the obtained set of software samples and the components that constitute the configuration of the ICS being simulated on the test device 210. The generated series includes at least one test. The scenario of each test describes the interaction between the components of the ICS under test and at least one sample used by a software under study. On the one hand, the testing involves the execution of at least one interaction scenario of the components of the ICS under test, wherein the at least one execution is performed after the infection / embedding of at least one sample of the software under study in the technical network of the test device 210.

[0087] As an illustrative example, suppose we consider an example of a test scenario. Also assume that the ICS consists of the following two components:

[0088] Computer А, which contains the SCADA system, and

[0089] Computer B, which contains a PLC controller which in turn monitors the operation of the pump.

[0090] Then, according to the scenario, a sample of malware has been embedded in the test device 210. The pump is designed to fill a water tank with water. Computer A exchanges data with computer B via the protocol OPC UA. Therefore, every second, computer A requests information about the status and operation mode of the pump from computer B, where the data about the operation mode contains the following information: whether the pump is on or off, how much water the pump is pumping, and how much water the pump has pumped (filled into the water tank). If the water tank is full, computer А sends a command to computer B to turn off / stop the pump. In the given example, the metrics evaluated are:

[0091] the speed at which requests are sent from computer А to computer B, and

[0092] · Delayed response of computer A to computer B reporting that the water tank is full.

[0093] Thus, the testing includes collecting data (i.e., monitoring) about the communication between components that make up the ICS configuration. The collected data includes at least: the time to send a request from one component of the ICS configuration to another component, the time to respond to a request from another component of the ICS configuration, and the latency of a component reacting to a command acting on a component of the ICS.

[0094] In this research scenario, a sample of malware may have certain effects, such as the following effects: increase the processing time of a request for information about a condition, and / or increase the time to send a response to a request for information. For example, if the response to information was originally sent once a second, it may now be sent every three seconds or more, in which case it may appear that the computer А reacts late to the overloading of the water tank.

[0095] In another example, assume there is a scenario where a component (e.g., the pump described above) is assigned a certain parameter enablement range. Also assume that the time to shut down the pump is 1 second, and that during operation it has been determined that disconnection occurs within 0.2 seconds (e.g., on average). Also assume that during testing for malware, the average time to disconnect the pump was 0.8 seconds. 0.8 seconds may not be considered significant, but there may not be much time to deal with the unexpected. For example, the productivity of the pump may be reduced for other legitimate reasons, and time resources may not be available for legitimate reasons.

[0096] In one aspect, during the test, the availability monitor 230 also generates a report on the impact of the software under study, which is embedded in the test device 210 (the ICS being tested). In one aspect, the report on the impact of the software under study is generated based on the parameters of the metrics, which are defined primarily to be able to assess the productivity of the ICS and temporary failures in operation (e.g., denial of service). An example of a typical failure in ICS operation is a situation where a network service or an entire computer does not perform its intended function. In the previous example, if computer A does not poll computer B when the pump is running, the water tank will overflow, which may cause damage to the pump and more serious consequences may occur.

[0097] In one aspect, the results of the performed tests are sent by the availability monitor 230 to the impact assessor 240. In one aspect, the results are sent in the form of a report.

[0098] In one aspect, the results include information about at least one of: the working capacity, productivity, effectiveness, and operating quality of the ICS as a whole and each of its components; data exchanged during component interaction; any deviations occurring in the ICS; and samples of the software studied for testing.

[0099] In one aspect, impact assessor 240 is designed to assess the degree of impact (impact level) of the software under study on the ICS in question based on measurements of metric parameters taken by availability monitor 230 during execution of tests of a specific configuration of the ICS simulated on test device 210 .

[0100] During analysis of the acquired data, the impact assessor 240 assesses the impact of each studied software on the ICS and determines the consequences that may occur if the ICS is infected by the corresponding studied software. The consequences determined by the impact assessor 240 include an indication of the type and extent of harm that will be caused to the tested configuration of the ICS. In other words, it is determined what constitutes harm.

[0101] In one aspect, the assessment of the impact can be based on probabilistic techniques. For example, a number indicating the probability can be given in the range of 0 (corresponding to the lowest probability) to 100 (corresponding to the highest probability). Thus, when performing the test, a non-zero impact assessment can be achieved even if the components of the IACS, in particular the components of the ICS, operate within the permitted range. This makes it possible to detect indicators of danger to the ICS even if each individual component operates within the permitted range. Due to the weighted assessment of all components, the sum of these components indicates whether a danger exists.

[0102] In another aspect, the impact assessor 240 additionally generates recommendations based on the assessment performed. In one aspect, the recommendations may include the following types of information:

[0103] Recommendations for detecting indicators of infection of ICS-enabled systems with dangerous software (malware), including without the need to install special software (e.g., antivirus software);

[0104] Tips for preventing malware infection;

[0105] · Recommendations for eliminating infections or embedded software and their consequences;

[0106] Recommendations for remediating ICS components or network traffic (data sent during component interactions) that are affected by samples of the studied software; and

[0107] Recommendations for performing additional testing.

[0108] On the one hand, during the assessment, the most dangerous malware can also be determined. On the one hand, the most dangerous software is the software that causes irreversible deviations in the ICS.

[0109] In one aspect, impact assessor 240 can generate a risk level based on a series of studies of various configurations of ICS. In one aspect, the risk level contains information about the most dangerous malware to the technical system (network).

[0110] Figure 3 An exemplary test apparatus 300 according to the present invention is shown, which is designed to simulate a specific configuration of an IACS, in particular an ICS.

[0111] In one aspect, test equipment 210 represents the necessary testing infrastructure to perform simulation of a specific configuration of an ICS in order to investigate the vulnerability of the ICS against the software under investigation.

[0112] In order to generate a specific configuration of the ICS, the test device 210 contains various components of the ICS (from which the necessary components are selected for testing) and at least one server for generating the necessary workstations of the user or virtual machines. The server for generating the necessary workstations of the user can be implemented as a virtualized server (i.e. ESXi) or on physical hardware. It should be noted that, depending on several aspects of the test device 210, the user's workstation and the virtual machine can be interchangeable. The test device 210 also includes a software selector 220, an availability monitor 230 and an impact assessor 240. All units of the test device 210 are integrated into a technical network through which they interact. The technical network can be divided into several networks. Thus, for example, Figure 3 Three networks are schematically shown through network cards (NIC#1, NIC#2 and NIC#3). A network card (or network interface controller / network interface card) is also called a network adapter.

[0113] The test device 210 enables the following preliminary actions required for conducting the test to be performed. The preliminary actions may include actions for:

[0114] Set up the ICS components and hosts on the server.

[0115] Install various components of ICS on the test device, connect to ICS and create data flows;

[0116] · Control and technical processing for components of the ICS located in separate virtual local area networks (NIC #1 and NIC #2, respectively); and

[0117] Remotely connect to components of the ICS (via NIC #3) to perform testing and research as a whole.

[0118] Figure 4 An exemplary scenario 400 of the impact of malware on an IACS (eg, ICS) during which a denial of service occurs according to the present invention is shown. The scenario 400 includes five main steps.

[0119] In a first step, a sample of malware 420 is embedded on a workstation 440 on which at least one component of the ICS is installed. The sample generates during its execution a lock on the workstation 440 or a modification of local resources of the workstation 440. Examples of local resources are central processing unit (CPU), main memory (RAM), files, registers, etc. Thus, modification refers to a large consumption of CPU / RAM or a change in the memory of a process, file or register.

[0120] In the second step, components of ICS 460 attempt and fail to gain access to local resources of workstation 440 that have been locked or altered by the malware sample.

[0121] In a third step, a component of the ICS 460 becomes unstable (eg, it locks up or crashes) or fails to function properly (ie, monitors a technical process while working with field devices), resulting in a denial of service 470 .

[0122] • In the fourth step, the availability monitor 230 collects the events that have occurred in the previous steps 1-3.

[0123] • In a fifth step, the availability monitor 230 compiles a report 480 on the anomalies found.

[0124] Other scenarios may involve modifications to several local resources (e.g., configuration of the operating system, configuration files of applications, etc.), which may affect incorrect operation of components of the ICS, as well as locking or modification of network resources (e.g., DoS of network devices and PLCs).

[0125] For example, the Windows Performance Analysis (WPA) productivity analysis framework can be used and the availability monitor 230 developed on the user driver of the filter. Using WPA and developing the availability monitor 230 on the user driver of the filter makes it possible to detect a wide range of events.

[0126] Figure 5 A block diagram is shown that illustrates an exemplary method 500 for evaluating the impact of software (eg, malware) on components of an IACS in accordance with the present invention. Figure 2 The method 500 is implemented by the system described in .

[0127] In step 510, method 500 selects samples of software being analyzed (ie, software being studied) for its potential ability to cause damage to industrial automation and control systems (IACS), particularly industrial control systems (ICS).

[0128] In one aspect, the selection of the sample of software is performed using any number of criteria indicative of an impact that represents a threat to at least one of: availability, operational capability, and integrity of the configuration of the IACS.

[0129] In one aspect, the selection of samples of software is performed by: launching and running each sample of the software in an isolated environment of a sandbox; generating an event log during the run in the sandbox, wherein the generated event log contains all activities that occurred during the run; and selecting a suitable sample of the software to be studied for testing on the test device based on the analysis of the generated event log. Thus, based on the analysis of the generated event log (i.e., the event log generated from the run in the sandbox), a suitable "software to be studied" is selected for testing on the test device 210.

[0130] In step 530 , for each specific configuration of the IACS being tested, method 500 performs analysis to identify the impact of the selected sample of the software under investigation on the specific configuration of the IACS, wherein the identified impacts include at least causes and events that caused the specific configuration of the IACS to be disrupted.

[0131] In one aspect, the testing includes monitoring requests and responses between components of a particular configuration, collecting data, the data including at least one of:

[0132] The time it takes to send a request from one component to another in a particular configuration,

[0133] The time to respond to a request from a specifically configured component, and

[0134] • The delay time for components to react to commands acting on a specific configuration of the IACS.

[0135] In one aspect, the analysis for identifying the impact of the selected samples is performed in an automated manner.

[0136] On the one hand, the analysis for identifying the impact of the selected sample includes performing at least one test, which is intended to collect data about the impact of the selected software on the configuration of the IACS being tested and simulated on the test device 210. The number of tests will depend on the number of software being studied. During each test, the sample of the software being studied is embedded in the configuration of the IACS being tested, and certain data information exchanges are performed between the various components of the configuration of the IACS being tested. The information exchange of data is determined according to the actual components of the configuration and the tasks that these components need to perform. During each test, all identified reasons and / or events that cause the interruption of the operation of the test device 210 that simulates the configuration of the IACS are recorded. An example of an interruption can be any deviation in the operation of the components of the configuration of the IACS, which can cause a denial of service of the corresponding components, or cause a denial of service of the entire configuration of the IACS as a whole.

[0137] In step 550, for each specific configuration of the IACS being tested, the method 500 analyzes all identified causes and events that resulted in interruptions in the specific configuration of operation of the IACS.

[0138] In one aspect, the reason includes at least one of: a time to send a request exceeding a first predetermined threshold, a time to respond to a request exceeding a second predetermined threshold, and a delay in reacting exceeding a third predetermined threshold.

[0139] In step 570 , for each specific configuration of the IACS being tested, method 500 evaluates the impact of the selected sample of software by determining, based on analysis, the degree of impact of the software on the specific configuration of the IACS and the probability of degradation of computing resources of the specific configuration of the IACS.

[0140] The selected software whose impact is assessed is the “investigated software.” Based on the analysis, the extent of the impact of the investigated software on the specific configuration of the IACS is determined. In addition, the method 500 also determines the probability of degradation of computing resources for the specific configuration of the IACS being simulated on the test device 210.

[0141] In one aspect, the method further comprises, for each specific configuration of the IAS being tested, generating recommendations based on an assessment of the impact of the selected sample of the software, the recommendations comprising at least one of: a recommendation to initiate detection of indicators of infection by the sample of the software, a recommendation to prevent infection by the selected sample of the software, a recommendation to delete the sample of the software and remove the consequences of infection by the sample of the software, a recommendation to correct components of the specific configuration affected by the sample of the software, and a recommendation to perform additional testing.

[0142] Figure 6A block diagram is shown that illustrates a specific example of a method 600 for assessing the impact of malware according to the present invention. The method 600 is Figure 5 The method 600 is a method for evaluating the impact of malware that causes a denial of service of a component of a particular configuration of an IACS. Figure 2 The system described in embodies the method 600 of the present invention.

[0143] Assume that a specific configuration of an IACS needs to be tested to evaluate the impact of malware on the specific configuration of the IACS, i.e., to evaluate the robustness of the IACS. To start the test, first, a specification is sent to the test device 210, wherein the specification contains information about the components of the IACS and their functional performance. In addition, the specification may also contain information about how components interact or how data is exchanged. This information is relevant if components of the configuration of the IACS have been modified and the interactions that occur are not standard for the system being tested for vulnerabilities.

[0144] In step 610, method 600 generates a specific configuration of the IACS on test equipment 210 according to the received specification for testing. This process may involve connecting or disconnecting certain components (devices) to fully comply with the received specification.

[0145] In one aspect, method 600 includes generating a configuration of the IACS on a test device based on a received specification for testing, wherein the specification includes information about at least one of: components of the IACS, functional performance of the components of the IACS, interactions occurring between components of the IACS, and information about data exchanged between components of the IACS.

[0146] In step 620, method 600 obtains a set of software to be studied, wherein the set of software includes at least one sample of a malware. Because there are a large number of malware, the set of software to be studied may be initially limited. For example, the limitation may be based on the prevalence or threat level of the malware sample.

[0147] In one aspect, method 600 further includes optional step 615, wherein the software sample is selected based on at least one of the following: the type of industrial system, the component of the industrial system, the component of the configuration of the IACS being tested. In other words, the set of software being studied can be pre-selected in optional step 615, and the set of software being studied can correspond to a specific type of equipment or device including the component of the IACS configuration being tested. In one aspect, in optional step 615, based on the analysis of malware in a simulated environment of a sandbox (or sandbox type) and the subsequent generation of event logs, the event log of each sample of the malware is analyzed, and the appropriate malware is selected for testing based on the analysis of the event logs, to complete the selection of the set of software being studied.

[0148] In one aspect, the selection of malware is performed using a series of criteria indicating an impact that represents a threat to at least one of: availability, operational capability, and integrity of a respective specific configuration of the IACS.

[0149] In step 630, method 600 uses test equipment 210 to test the generated configuration of the IACS using the received set of software under investigation. During the test, information exchange of data is performed between various components of the IACS configuration. The test includes scenarios in which data is exchanged during the test. In addition, the scenario also involves the use of samples of malware during the test.

[0150] In step 640 , during testing, the method 600 identifies the occurrence of a denial of service of components of the test device 210 that are used to simulate a particular configuration of the IACS.

[0151] In step 650, the method 600 analyzes all identified causes and events related to the occurrence of an identified denial of service indicating a disruption in the operation of the test device 210 of the particular configuration emulating the IACS.

[0152] At step 660, method 600 determines the impact of the malware on the specific configuration of the IACS and the extent to which the performance of the specific configuration of the IACS has been degraded.

[0153] In step 680, method 600 makes a determination of the dangerousness of a particular malware to a particular configuration of the IACS based on the determined impact of the corresponding malware.

[0154] In step 690, method 600 identifies a compromise indicator of a fault affecting operation of a particular configuration of the IACS. Note that steps 680 and 690 may be interchanged and may be performed in parallel.

[0155] Figure 7 is a block diagram illustrating a computer system 20 according to an exemplary aspect on which aspects of the systems and methods for evaluating the impact of software on components of industrial automation and control systems may be implemented. The computer system 20 may be in the form of multiple computing devices, or in the form of a single computing device, such as a desktop computer, a laptop computer, a handheld computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

[0156] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 connecting various system components, including a memory associated with the central processing unit 21. The system bus 23 may include a bus memory or a bus memory controller, a peripheral bus, and a local bus capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, and the like. TM (HyperTransport TM ), unlimited bandwidth TM (InfiniBand TM ), Serial ATA, I 2 C, and other suitable interconnections. The central processing unit 21 (also referred to as a processor) may include a single group or multiple groups of processors having a single core or multiple cores. The processor 21 may execute one or more computer executable codes that implement the technology of the present invention. The system memory 22 may be any memory for storing data used herein and / or computer programs executable by the processor 21. The system memory 22 may include volatile memory (such as random access memory (Random Access Memory, RAM) 25) and non-volatile memory (such as read-only memory (Read-Only Memory, ROM) 24, flash memory, etc.) or any combination thereof. The basic input / output system (Basic Input / Output System, BIOS) 26 may store basic programs for transmitting information between elements of the computer system 20, such as those basic programs when the operating system is loaded using ROM 24.

[0157] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the one or more non-removable storage devices 28 are connected to the system bus 23 via a memory interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data for the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory, such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as in a Solid State Drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage, such as in a hard drive or floppy disk; optical storage, such as in a compact disc (CD-ROM) or a digital versatile disc (DVD); and any other medium that can be used to store the desired data and can be accessed by the computer system 20.

[0158] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional application programs 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for transmitting data from input device 40, such as a keyboard, mouse, light pen, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner via one or more I / O ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 via output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 can also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0159] The computer system 20 can work in a network environment using a network connection with one or more remote computers 49. The one or more remote computers 49 can be local computer workstations or servers, which include most or all of the elements described above when describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, websites, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computers 49 via one or more networks, such as a local area computer network (LAN) 50, a wide area computer network (WAN), an intranet, and the Internet. Examples of the network interface 51 may include an Ethernet interface, a frame relay interface, a SONET (Synchronous Optical Network) interface, and a wireless interface.

[0160] Various aspects of the present invention may be systems, methods and / or computer program products. The computer program products may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform various aspects of the present invention.

[0161] Computer readable storage medium can be a tangible device, and this tangible device can keep and store the program code of the form of instruction or data structure, and this program code can be accessed by the processor of computing device (such as computing system 20).Computer readable storage medium can be electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or its any suitable combination.As an example, this type of computer readable storage medium can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), portable optical disc read-only memory (CD-ROM), digital versatile disc (DVD), flash memory, hard disk, portable computer disk, memory stick, floppy disk or even mechanical coding device, such as punch card or convex structure in the groove of recording instruction thereon.As used in this article, computer readable storage medium should not be regarded as temporary signal itself, temporary signal such as radio wave or other free propagation electromagnetic wave, electromagnetic wave propagated by waveguide or transmission medium or electric signal transmitted by wire.

[0162] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing device.

[0163] The computer-readable program instructions for performing the operation of the present invention can be assembler instructions, instruction set architecture (Instruction-Set-Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​and traditional programmed programming languages).Computer-readable program instructions (as independent software packages) can be performed completely on the user's computer, partly on the user's computer, partly on the user's computer and partly on a remote computer or completely on a remote computer or server.In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected to an external computer (for example, through the Internet).In some respects, electronic circuits (including for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (Programmable Logic Arrays, PLAs)) can be performed by utilizing the state information of computer-readable program instructions to personalize the electronic circuit, thereby performing various aspects of the present invention.

[0164] In various aspects, the systems and methods described in the present invention can be processed in modules. The term "module" as used herein refers to, for example, a real-world device, component, or arrangement of components implemented using hardware (e.g., via an application-specific integrated circuit (ASIC) or FPGA), or to a combination of hardware and software, such as a microprocessor system and an instruction set that implements the module's functionality (which, when executed, converts the microprocessor system into a dedicated device). A module can also be implemented as a combination of two modules, in which certain functions are facilitated by hardware alone and other functions are facilitated by a combination of hardware and software. In some implementations, at least a portion of a module (and in some cases, all of a module) can be implemented in a computer system (such as described above in Figure 7Therefore, each module can be implemented in various suitable configurations and should not be limited to any specific implementation illustrated in this article.

[0165] For the sake of clarity, not all routine features of various aspects are disclosed herein. It should be appreciated that in the development of any practical implementation of the present invention, many specific implementation decisions must be made in order to achieve the developer's specific goals, and these specific goals will vary for different implementations and different developers. It should be understood that such development efforts can be complex and time-consuming, but are still a routine task of engineering for those of ordinary skill in the art who understand the advantages of the present invention.

[0166] In addition, it should be understood that the words or terms used herein are for the purpose of description rather than limitation, so the terms or terms of this specification should be interpreted by those skilled in the art according to the teachings and guidance provided herein in combination with the knowledge of (one or more) relevant technical personnel. In addition, it is not intended to attribute any term in this specification or claims to an uncommon or special meaning unless explicitly stated as such.

[0167] The various aspects disclosed herein include the present and future known equivalents of the known modules cited herein in an illustrative manner. In addition, although various aspects and applications have been shown and described, it will be apparent to those skilled in the art who understand the advantages of the present invention that more modifications than those mentioned above are feasible without departing from the inventive concept disclosed herein.

Claims

1. A method for evaluating the impact of software on a component of an industrial automation and control system, the method comprising: A sample of software to be analyzed is selected for its potential to cause damage to industrial automation and control systems, wherein the selection of the sample of software is performed by: Launch and run each sample of the software in an isolated environment of the sandbox; generating an event log during execution in the sandbox, wherein the generated event log contains all activities that occurred during the execution; and selecting one or more samples of the software to be studied for testing on a test device based on an analysis of the generated event log; generating one or more configurations of the industrial automation and control system for testing on the test device according to the received specification for testing; for each specific one of the one or more generated configurations of the industrial automation and control system being tested, performing analysis to identify an effect of the selected sample of the software on the specific configuration of the industrial automation and control system, wherein the identified effect includes at least a cause and event that caused an interruption in operation of the specific configuration of the industrial automation and control system, the specific configuration including at least the components of the industrial automation and control system being simulated on the test device, wherein the testing includes monitoring requests and responses between components of the specific configuration; For each specific configuration of the industrial automation and control system being tested, analyzing all identified causes and events that resulted in interruptions in operation of the specific configuration of the industrial automation and control system; and For each specific configuration of the industrial automation and control system being tested, based on the analysis, the impact of the selected sample of the software is evaluated by determining the degree to which the software affects the specific configuration of the industrial automation and control system.

2. The method of claim 1, wherein: Performing analysis to identify the impact of the selected samples also includes collecting data, the data including at least one of the following items: the time to send a request from one component of the particular configuration to another component, the time to respond to a request from a component of the particular configuration, and the latency time for a component to react to a command acting on the particular configuration of the industrial automation and control system.

3. The method of claim 1, wherein: The reasons for the interruption of operation of the specific configuration of the industrial automation and control system include at least one of the following items: the time for sending the request exceeds a first predetermined threshold, the time for responding to the request exceeds a second predetermined threshold, and the delay time for reacting exceeds a third predetermined threshold.

4. The method of claim 1, wherein: The selection of the sample of software is also performed using any number of criteria indicating an impact that represents a threat to at least one of: availability, operational capability, and integrity of a configuration of the industrial automation and control system.

5. The method of claim 1, further comprising: For each specific configuration of the industrial automation and control system being tested, generating recommendations based on an assessment of the impact of the selected sample of the software, the recommendations comprising at least one of: Recommendations for launching detection of indicators of infection by samples of said software; Recommendations for preventing infection by selected samples of said software; Recommendations for deleting samples of said software and removing the consequences of being infected by samples of said software; recommendations for remediating components of said particular configuration affected by a sample of said software; as well as Recommendations for performing additional testing.

6. The method of claim 1, wherein: The analysis for identifying the impact of the selected samples includes performing at least one test designed to collect data regarding the impact of the selected software on the configuration of the industrial automation and control system being tested and being simulated on the test device.

7. The method of claim 1, wherein: The specification includes information about at least one of: components of the industrial automation and control system, functional performance of the components of the industrial automation and control system, interactions occurring between components of the industrial automation and control system, and information about data exchanged between components of the industrial automation and control system.

8. The method of claim 1, wherein: The sample of software is selected based on at least one of: a type of the industrial automation and control system, a component of the industrial automation and control system, a component of a configuration of the industrial automation and control system being tested.

9. The method of claim 1, further comprising: For each specific configuration of the industrial automation and control system being tested, an assessment of the impact of the selected samples is performed by determining a probability of degradation of computing resources of the specific configuration of the industrial automation and control system.

10. A system for evaluating the impact of software on a component of an industrial automation and control system, the system comprising: At least one processor of a computing device, the processor being configured to: A sample of software to be analyzed is selected for its potential to cause damage to industrial automation and control systems, wherein the selection of the sample of software is performed by: Launch and run each sample of the software in an isolated environment of the sandbox; generating an event log during execution in the sandbox, wherein the generated event log contains all activities that occurred during the execution; and selecting one or more samples of the software to be studied for testing on a test device based on an analysis of the generated event log; generating one or more configurations of the industrial automation and control system for testing on the test device according to the received specification for testing; for each specific one of the one or more generated configurations of the industrial automation and control system being tested, performing analysis to identify an effect of the selected sample of the software on the specific configuration of the industrial automation and control system, wherein the identified effect includes at least a cause and event that caused an interruption in operation of the specific configuration of the industrial automation and control system, the specific configuration including at least the components of the industrial automation and control system being simulated on the test device, wherein the testing includes monitoring requests and responses between components of the specific configuration; For each specific configuration of the industrial automation and control system being tested, analyzing all identified causes and events that resulted in interruptions in operation of the specific configuration of the industrial automation and control system; and For each specific configuration of the industrial automation and control system being tested, based on the analysis, the impact of the selected sample of the software is evaluated by determining the degree to which the software affects the specific configuration of the industrial automation and control system.

11. The system of claim 10, wherein: The configuration for performing analysis to identify the impact of selected samples also includes a configuration for collecting data, wherein the data includes at least one of the following items: the time to send a request from one component of the specific configuration to another component, the time to respond to a request from a component of the specific configuration, and the latency time for a component to react to a command acting on the specific configuration of the industrial automation and control system.

12. The system of claim 10, wherein: The reasons for the interruption of operation of the specific configuration of the industrial automation and control system include at least one of the following items: the time for sending the request exceeds a first predetermined threshold, the time for responding to the request exceeds a second predetermined threshold, and the delay time for reacting exceeds a third predetermined threshold.

13. The system of claim 10, wherein: The selection of the sample of software is also performed using any number of criteria indicating an impact that represents a threat to at least one of: availability, operational capability, and integrity of a configuration of the industrial automation and control system.

14. The system of claim 10, wherein the processor is further configured to: For each specific configuration of the industrial automation and control system being tested, generating recommendations based on an assessment of the impact of the selected sample of the software, the recommendations comprising at least one of: Recommendations for launching detection of indicators of infection by samples of said software; Recommendations for preventing infection by selected samples of said software; Recommendations for deleting samples of said software and removing the consequences of being infected by samples of said software; recommendations for remediating components of said particular configuration affected by a sample of said software; as well as Recommendations for performing additional testing.

15. The system of claim 10, wherein: The analysis for identifying the impact of the selected samples includes performing at least one test designed to collect data regarding the impact of the selected software on the configuration of the industrial automation and control system being tested and being simulated on the test device.

16. The system of claim 10, wherein: The specification includes information about at least one of: components of the industrial automation and control system, functional performance of the components of the industrial automation and control system, interactions occurring between components of the industrial automation and control system, and information about data exchanged between components of the industrial automation and control system.

17. The system of claim 10, wherein: The sample of software is selected based on at least one of: a type of the industrial automation and control system, a component of the industrial automation and control system, a component of a configuration of the industrial automation and control system being tested.

18. The system of claim 10, wherein the processor is further configured to: For each specific configuration of the industrial automation and control system being tested, an assessment of the impact of the selected samples is performed by determining a probability of degradation of computing resources of the specific configuration of the industrial automation and control system.

19. A non-transitory computer readable medium having stored thereon computer executable instructions for evaluating the impact of software on a component of an industrial automation and control system, the computer executable instructions comprising instructions for: The samples of software to be analyzed were selected for their potential to cause damage to industrial automation and control systems, The selection of samples of the software is performed by: Launch and run each sample of the software in an isolated environment of the sandbox; generating an event log during execution in the sandbox, wherein the generated event log contains all activities that occurred during the execution; and selecting one or more samples of the software to be studied for testing on a test device based on an analysis of the generated event log; generating one or more configurations of the industrial automation and control system for testing on the test device according to the received specification for testing; for each specific one of the one or more generated configurations of the industrial automation and control system being tested, performing analysis to identify an effect of the selected sample of the software on the specific configuration of the industrial automation and control system, wherein the identified effect includes at least a cause and event that caused an interruption in operation of the specific configuration of the industrial automation and control system, the specific configuration including at least the components of the industrial automation and control system being simulated on the test device, wherein the testing includes monitoring requests and responses between components of the specific configuration; For each specific configuration of the industrial automation and control system being tested, analyzing all identified causes and events that resulted in interruptions in operation of the specific configuration of the industrial automation and control system; and For each specific configuration of the industrial automation and control system being tested, based on the analysis, the impact of the selected sample of the software is evaluated by determining the degree to which the software affects the specific configuration of the industrial automation and control system.

Images