A vulnerability detection method for new energy edge industrial control systems based on Raspberry Pi

Abstract

The present invention discloses a vulnerability detection method for a new energy edge industrial control system based on Raspberry Pi, comprising the following steps: S01, based on the burning of the Raspberry Pi development board system, constructing an industrial control vulnerability detection fingerprint library, adding industrial control protocol vulnerabilities, industrial control information detection scripts and industrial control PLC vulnerability detection scripts to the Raspberry Pi; S02, using the industrial control information detection script to perform survival detection on the industrial control host to obtain a surviving industrial control host; S03, using the industrial control PLC vulnerability detection script to detect the port of the surviving industrial control host address, determine the open port number, scan the open port of the industrial control host to be detected, and identify the industrial control protocol, and find the industrial control protocol vulnerability; S04, according to the industrial control vulnerability detection fingerprint library, formulate a vulnerability detection POC code to verify the industrial control protocol vulnerability. A vulnerability detection method for a new energy edge industrial control system based on Raspberry Pi provided by the present invention can make full use of the convenience and scalability of Raspberry Pi deployment to improve the efficiency of vulnerability detection in the new energy edge industrial control system.

Description

Technical Field

[0001] The present invention specifically relates to a new energy edge industrial control system vulnerability detection method based on Raspberry Pi, belonging to the technical field of vulnerability detection. Background Art

[0002] Most of my country's new energy wind power plants are located in remote areas, and the wind turbines are relatively scattered. Currently, four levels of control are used, namely the field side, the station side, the centralized control side, and the master control side. The field side mainly refers to the wind turbine master control issuing various control and adjustment commands to the field side. New energy edge industrial control systems generally use foreign industrial control equipment and industrial control system protocols, and face serious network security risks.

[0003] The security of the new energy wind power network system can directly affect the stability of new energy wind power generation. The Modbus / TCP protocol is used in the main control equipment of the new energy wind power wind turbine to realize wind turbine control, steering and other control actions. Through experiments, it can be realized that a man-in-the-middle attack can be carried out wirelessly, and the control instructions can be replayed to cause the wind turbine to unexpectedly shut down or repeatedly start and stop. Attackers use the boundary security risks of new energy wind power to attack wind farms, which can directly cause wind turbines to unexpectedly shut down or restart. Once attacked by the network, the safety of the wind farm will be seriously affected.

[0004] At present, traditional automated vulnerability detection technology is based on vulnerability fingerprint detection and fuzzy recognition technology. Traditional vulnerability detection technology based on fingerprint detection requires the setting of a large number of vulnerability fingerprint libraries, and the fingerprint library cannot be modified. It needs to initiate a large number of request messages and has a low recognition rate. Fuzzy recognition technology mainly constructs abnormal data packets to detect the response of the target under test to determine service vulnerabilities. The intelligent probe Sulley is mainly for fuzz testing of protocols, and the parameters of the detection protocol need to be manually set. Peach fuzzer uses "deformed files" to detect the stability of the target device and the robustness of the target code. It is not suitable for detecting industrial control components in operation. Existing industrial control security detection equipment is deployed on traditional hosts, which is slow to update and upgrade, inconvenient to carry, and has high power consumption and is difficult to deploy. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a new energy edge industrial control system vulnerability detection method based on Raspberry Pi, which can fully utilize the convenience and scalability of Raspberry Pi deployment and improve the efficiency of new energy edge industrial control system vulnerability detection.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A new energy edge industrial control system vulnerability detection method based on Raspberry Pi, comprising the following steps:

[0008] S01, based on the Raspberry Pi development board system burning, construct the industrial control vulnerability detection fingerprint library, add industrial control protocol vulnerabilities, industrial control information detection scripts and industrial control PLC vulnerability detection scripts to the Raspberry Pi;

[0009] S02, using the industrial control information detection script to perform survival detection on the industrial control host to obtain a surviving industrial control host;

[0010] S03, using the industrial control PLC vulnerability detection script to detect the port of the surviving industrial control host address, determine the open port number, scan the open port of the industrial control host to be detected and identify the industrial control protocol, and find the industrial control protocol vulnerability;

[0011] S04, formulating a vulnerability detection POC code according to the industrial control vulnerability detection fingerprint library, verifying the industrial control protocol vulnerability, and implementing industrial control protocol vulnerability detection.

[0012] In S01, the system burning of the Raspberry Pi development board is achieved using a wireless access device.

[0013] In S02, for the IP address segment to be detected, the ICMP protocol is used to detect the IP address segment, and the C segment detection is performed on each surviving address segment, and the open ports and services are determined. According to the IPv4 address construction structure, the IP address is traversed in a loop, and the B segment, C segment, and D segment are traversed incrementally respectively.

[0014] In S03, the nmap scanner is called to perform a full port scan on a specific host and identify the industrial control protocol. The nmap scanner is provided with a detection script NSE for different industrial control protocols.

[0015] The entire process from S01 to S04 is based on network traffic detection. The data detection area is determined from the network traffic that has been detected and confirmed to have vulnerabilities. The key control instructions of the industrial control system are collected in the data detection area, and then the feature word retrieval algorithm is used to filter the frequently used key control instructions. A replay attack is constructed based on the filtered key control instructions to detect the security of the industrial control protocol.

[0016] The feature word retrieval algorithm includes the following steps:

[0017] A weighted feature word fingerprint library is constructed based on the data detection area D. The weighted feature word fingerprint library is defined as FingerPrint={k1,k2,···k n}, where k1, k2, ... k n is a set of feature words to be retrieved, and the subscript n represents the sequence number of the specified nth feature word;

[0018] Query the weighted feature words in the weighted feature word fingerprint library multiple times, and calculate the maximum value Q in the j-th query feature word fingerprint library j , Q j =max{k1·w1,k2w2,···k n w n}, where w1,w2,...w n They are feature words k1, k2, ...k n The weight value in the data detection area D is used to calculate the mapping distribution of weighted feature words in the data detection area D for the jth query. in represents the mapping index, D j represents the value taken on the data detection area D for the jth time;

[0019] According to Q j and D j Numerical calculation of the final feature distribution

[0020] The beneficial effects of the present invention are as follows: the present invention provides a new energy edge industrial control system vulnerability detection method based on Raspberry Pi, which is based on the low-cost Raspberry Pi and fully utilizes the convenience and scalability of Raspberry Pi deployment to build an industrial control vulnerability detection platform, which can improve the network security defense capability of the new energy industrial control system and the efficiency of vulnerability detection of the border industrial control system; utilizes known industrial control vulnerability fingerprints and new energy industrial control feature active mining technology to construct a new energy industrial control system feature word database pool, uses an algorithm to locate the high-frequency feature word distribution, and realizes system vulnerability detection of the new energy edge industrial control, which can solve the network security detection problem of the new energy edge industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a schematic diagram of the vulnerability detection principle based on Raspberry Pi of the present invention;

[0022] Figure 2 This is a schematic diagram of the industrial control protocol fuzzy test in the present invention;

[0023] Figure 3 Schematic diagram of Modbus communication request mode in the present invention;

[0024] Figure 4 This is a schematic diagram of wireless remote attack on new energy edge industrial control in the present invention;

[0025] Figure 5 It is a schematic diagram of the characteristic model of sensitive control instructions of the new energy industrial control system in the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the protection scope of the present invention.

[0027] The present invention discloses a vulnerability detection method for a new energy edge industrial control system based on Raspberry Pi. Based on an expandable lightweight Raspberry Pi development board, a database space of feature words of a new energy industrial control system is constructed, and the distribution of feature words of control instructions of a new energy industrial control system is calculated to realize system vulnerability detection of new energy edge industrial control. The specific detection principle of the present invention is as follows Figure 1 As shown, firstly, the system image file is burned into the Raspberry Pi, then active information detection and collection are performed, data packets are extracted, the control instruction data packets of the new energy industrial control system are decomposed, and data packets are reconstructed. Finally, the new energy industrial control instruction replay attack is performed to detect the security of the industrial control protocol. The specific steps include:

[0028] Step 1: Burn the system based on the Raspberry Pi development board, configure the wireless access device, construct the industrial control vulnerability detection fingerprint library, add industrial control protocol vulnerabilities, industrial control information detection scripts and industrial control PLC vulnerability detection scripts, and expand the underlying dependency library files supported by the aggregation platform.

[0029] Step 2: New energy edge industrial control system host survival detection. The industrial control information detection script implements cyclic detection of the specified IP address segment. The purpose is to determine the survival of the industrial control host. For websites, servers, databases, business application systems, etc. that can be accessed in the new energy area, it is necessary to determine the IP address segment to be detected, and use the ICMP protocol to detect the address segment. Perform C segment detection on each surviving address segment, and determine the open ports and services. According to the IPv4 address construction structure, the IP address is cyclically traversed, and the B segment, C segment, and D segment are traversed incrementally respectively, each traversal from 0-255. The following is the core code implementation part of the Raspberry Pi development board embedded in the industrial control information detection script.

[0030]

[0031]

[0032] Step three, detect the ports of the surviving host addresses, determine the open port numbers, call the nmap scanner to determine the specific services, and customize the nmap script NSE for the unique industrial control protocol. The main function of port scanning is to discover the host or network, the services on the host, and to discover the vulnerabilities of the services. The four flags of TCP are SYN, ACK, RST, and FIN. By setting the flag bit scan, the openness of the port can be detected covertly. The port scan establishes a complete connection with the target host through the three-way handshake of the TCP / IP protocol. The system calls the connect function and returns "-1" to indicate that the port is closed. If SYN / ACK is received, the scanner must send another RST signal. Figure 2 It calls the Nmap kernel tool, collects information on the input target in a customized way, and performs fuzz testing on unknown industrial control protocols. Nmap is an open source tool for network exploration and security auditing. It is designed to quickly scan large networks. It is also often used to detect some common vulnerabilities. The NSE script used by Nmap for scanning (the part of the industrial control PLC vulnerability detection script) can be independently written according to the characteristics of the industrial control protocol, calling the nmap tool to perform a full port scan on a specific host and identify the industrial control protocol. Nmap's NSE script mainly includes rule functions and action functions. When the rule function returns true, the action function starts to execute. It can realize the rapid detection of specific industrial control protocols for new energy. Industrial control protocols such as the Modbus protocol are widely used in new energy industrial control equipment. For the fixed port number of the protocol, you can write an NSE script to detect the port number opened by the industrial control equipment. Figure 3 It is Modbus protocol communication mode, using master-slave mode communication.

[0033]

[0034] Industrial control equipment Siemens, there is a man-in-the-middle attack on Siemens HMI, which can be detected based on the Nmap script NSE and the vulnerability features. Lua script can be written to detect this vulnerability in the new energy industrial control system. Figure 4 In order to implement a wireless remote attack scenario diagram for the new energy edge industrial control system, the attacker collects information in the early stage and fuzzily identifies the industrial control protocol, and then carries out a replay attack on the new energy industrial control equipment to detect the security of the protocol.

[0035]

[0036] The present invention also sets an aggregator to realize the aggregation of new energy industrial control vulnerability detection modules. The aggregator itself does not produce security scanning functions, but will serve as an integrated platform for security scanning tools. When a target is added, the aggregation scanner will automatically call various scanners and custom feature scanning scripts to initiate detection requests to the target host, and enter the scanning results into the aggregation scanner platform for aggregation and classification display. The bottom layer is mainly used for vulnerability feature detection scripts developed for industrial control system features, aiming to detect industrial control system vulnerabilities used in new energy industrial control systems. At the same time, the fuzzy recognition function of industrial control protocols is added to quickly locate industrial control equipment, providing reference defense opinions for strengthening security protection in the later stage.

[0037] The tools for building the underlying information collection mainly use open source information collection tools: Sqlmap, Nmap, Masscan, Fscan, Smod, ISF, ICS, Scada_Search, PLC_Scan, ICSSecurityScripts, Goon, Xray, etc. as the underlying information collection tools, and at the same time expand the vulnerability detection scripts for new energy industrial control protocols and PLC equipment.

[0038] Step 4: Specify custom POCs for vulnerability detection for common vulnerabilities in industrial control systems and verify known vulnerabilities. Unauthorized access vulnerabilities often exist in new energy industrial control system networks. Service configurations such as redis, mongodb, memcached, elasticsearch, zookeeper, FTP, CouchDB, docker api, Hadoop, rsync, mysql, and jenkins do not meet security level standards, resulting in unauthorized access vulnerabilities. Attackers can directly obtain system service permissions through unauthorized services. Unauthorized access vulnerability detection is defined in the extended detection module. For example, unauthorized access to Redis can be detected based on a fixed port number by calling the socket function to determine whether a connection to the target host can be established on that port.

[0039]

[0040] Step 5: The entire process from step 1 to step 4 is based on network traffic detection. The data detection area is determined from the network traffic that is confirmed to have vulnerabilities. The key control instructions of the industrial control system are collected in the data detection area. The key control instructions of the new energy industrial control system that are used frequently are determined based on the new energy industrial control system feature word retrieval algorithm. The replay test of the key control instructions of the new energy industrial control system is performed to confirm whether there is a replay attack on the industrial control protocol and avoid attacks that leak plaintext information.

[0041] The feature word retrieval algorithm includes the following steps:

[0042] A weighted feature word fingerprint library is constructed based on the data detection area D. The data detection area D refers to the entire new energy industrial control system application layer traffic block to be detected. The weighted feature word fingerprint library is defined as FingerPrint = {k1, k2, ···k n}, where k1, k2, ... k n It is a set of feature words to be retrieved, which is the definition of the feature words of the industrial control system application layer flow data. It can be expressed as industrial control system constants, control instructions, switch quantities, etc. The subscript n represents the serial number of the specified nth feature word.

[0043] Query the weighted feature words in the weighted feature word fingerprint library multiple times, and calculate the maximum value Q in the j-th query feature word fingerprint library j , Q j =max{k1·w1,k2w2,···k n w n}, where w1,w2,...w n They are feature words k1, k2, ...k n The weight value in the data detection area D is used to calculate the mapping distribution of weighted feature words in the data detection area D for the jth query. in represents the mapping index, D j Represents the jth value taken in the data detection area D.

[0044] According to Q j and D j Numerical calculation of the final feature distribution Figure 5 Schematic diagram of the analysis of sensitive control instruction characteristics of new energy industrial control systems.

[0045] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vulnerability detection method for new energy edge industrial control system based on Raspberry Pi, characterized by: The following steps are involved: S01, based on the Raspberry Pi development board system burning, construct the industrial control vulnerability detection fingerprint library, add industrial control protocol vulnerabilities, industrial control information detection scripts and industrial control PLC vulnerability detection scripts to the Raspberry Pi; S02, using the industrial control information detection script to perform survival detection on the industrial control host to obtain a surviving industrial control host; S03, using the industrial control PLC vulnerability detection script to detect the port of the surviving industrial control host address, determine the open port number, scan the open port of the industrial control host to be detected and identify the industrial control protocol, and find the industrial control protocol vulnerability; S04, formulating a vulnerability detection POC code according to the industrial control vulnerability detection fingerprint library, verifying the industrial control protocol vulnerability, and implementing industrial control protocol vulnerability detection, The entire process from S01 to S04 is based on network traffic detection. The data detection area is determined from the network traffic that has been detected and confirmed to have vulnerabilities. The key control instructions of the industrial control system are collected in the data detection area. Then, the key control instructions with high frequency are filtered using a feature word retrieval algorithm. A replay attack is constructed based on the filtered key control instructions to detect the security of the industrial control protocol. The feature word retrieval algorithm includes the following steps: Detecting regions based on data Construct a weighted feature word fingerprint library, which is defined as ,in is a set of feature words to be retrieved, and the subscript n represents the sequence number of the specified nth feature word; Query the weighted feature words in the weighted feature word fingerprint library multiple times, and calculate the maximum value in the j-th query feature word fingerprint library , ,in Characteristic words In the data detection area The weight value in is used to calculate the mapping distribution of weighted feature words in the j-th query data detection area D. ,in represents the mapping index, Indicates the jth time in the data detection area The value of ; according to and Numerical calculation of the final feature distribution .

2. According to a Raspberry Pi-based new energy edge industrial control system vulnerability detection method according to claim 1, it is characterized in that: In S01, the system burning of the Raspberry Pi development board is achieved using a wireless access device.

3. According to a Raspberry Pi-based new energy edge industrial control system vulnerability detection method according to claim 1, it is characterized in that: In S02, for the IP address segment to be detected, the ICMP protocol is used to detect the IP address segment, and the C segment detection is performed on each surviving address segment, and the open ports and services are determined. According to the IPv4 address construction structure, the IP address is traversed in a loop, and the B segment, C segment, and D segment are traversed incrementally respectively.

4. According to a Raspberry Pi-based new energy edge industrial control system vulnerability detection method according to claim 1, it is characterized in that: In S03, the nmap scanner is called to perform a full port scan on a specific host and identify the industrial control protocol. The nmap scanner is provided with a detection script NSE for different industrial control protocols.

Images