Industrial control network attack packet response method and response system based on honeypot system

Abstract

The application discloses a kind of based on honeypot system's industrial control network attack message response method and response system, wherein, the method includes the following steps: receiving attack message and screening out the valid industrial control protocol message in the attack message;From the valid industrial control protocol message, corresponding industrial control application data unit function code field and industrial control application data unit request data domain field are extracted, and the corresponding field of the data in the request response table in the honeypot system is matched, and according to different matching results, the response message corresponding to the result is replied.The based on honeypot system's industrial control network attack message response method and response system, by collecting and processing specific power industrial control network flow data, request response table can be generated, using the request response table, reasonable response with high fraud can be returned to the sniffer behavior of attacker.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly provides an industrial control network attack packet response method and system based on a honeypot system. BACKGROUND

[0002] An industrial control system (ICS) is composed of various automation control components and a series of process control components responsible for real-time data acquisition and monitoring. The components generally include a supervisory control and data acquisition (SCADA) system, a distributed control system (DCS), a programmable logic controller (PLC), a remote terminal unit (RTU), an intelligent electronic device (IED), and an interface responsible for communication between the components. At present, ICS has been widely used in power systems, and important relay protection equipment in various levels of substations has been connected to the power ICS network. If the power ICS is invaded, the consequences are unpredictable, so the security of ICS needs to be paid enough attention by people in the field of network security.

[0003] Most ICS protocols are based on general-purpose computers and operating systems and run on the TCP / IP protocol. This makes the security problems existing in the TCP / IP protocol inevitably affect the ICS protocols running on its application layer. In addition, due to the particularity of ICS, when the system is exposed to vulnerabilities, security patches are often not added immediately due to concerns about affecting production, leaving security risks. Moreover, ICS protocols themselves also have inherent security problems. Currently widely used communication protocols in the power industry, such as Modbus and IEC104, are designed under the assumption that the ICS network is isolated from external computer networks, so they lack the necessary security protection mechanisms in design. At the same time, information related to the protocol can be obtained through various means, increasing the chances of attackers exploiting vulnerabilities in communication protocols to attack ICS.

[0004] At present, the industrial control safety audit detection products are mostly based on bypass network flow and product itself feature library and other means to carry out network audit and safety detection, but due to the problems of packet loss of bypass flow, incomplete flow type and too much monitoring position to the network core layer, the bypass detection products are difficult to prevent complex attacks and have high false positive rate. At the same time, due to the characteristics of network isolation of industrial environment, the product cannot automatically update the feature library, causing serious lag of attack detection. The honeypot system can effectively solve the influence of the current industrial control safety products on the industrial control network, flow and real-time, make up for the problem that the security agent or security probe cannot be installed in the industrial control equipment, industrial control host and industrial control server. However, the current honeypot technology is not closely combined with the industrial control safety field, and the existing industrial control honeypot system has generally limited ability to imitate the interactive response behavior of industrial control equipment. At the same time, due to the complexity and diversity of power production scene, most of the existing honeypot systems cannot give reasonable response to the sniffing behavior related to the power industry, so that the honeypot is identified by the attacker and cannot further capture the malicious behavior of the attacker. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a honeypot system-based industrial control network attack message response method and response system to solve the problems in the prior art.

[0006] The present application provides a honeypot system-based industrial control network attack message response method, comprising the following steps:

[0007] S1: receiving attack messages and screening out valid industrial control protocol messages in the attack messages;

[0008] S2: extracting the corresponding industrial control application data unit function code field Func_code and industrial control application data unit request data field Request_data from the valid industrial control protocol messages, and matching the corresponding fields of the data in the request response table in the honeypot system, if the same data is matched, S3 is executed, if the extracted industrial control application data unit function code field Func_code is the same as the industrial control application data unit function code field Func_code of multiple data in the request response table, S4 is executed, otherwise, no response is given;

[0009] S3: the industrial control application data unit response data field Reply_data of the data matched from the request response table is spliced to the response data part to combine a response message to deceive the attacker;

[0010] S4: calculating the similarity between the Request_data field in the valid industrial protocol packet and the Request_data field in the matched data from the request-response table, and selecting the Reply_data field in the data with the largest similarity to splice into the response data part to combine a response packet to reply to the attacker.

[0011] Preferably, in S1, the valid industrial protocol packet is filtered out by matching the Port field in the industrial protocol transmission layer and the Func_code field in the network layer industrial application data unit.

[0012] Further preferably, in S4, the similarity between the Request_data field in the valid industrial protocol packet and the Request_data field in the matched data from the request-response table is calculated using the Smith-Waterman algorithm.

[0013] Further preferably, the industrial control network attack packet response method based on the honeypot system further comprises the step of recording the log of the interaction behavior with the attacker.

[0014] Further preferably, the industrial control network attack packet response method based on the honeypot system further comprises the step of constructing a request-response table in the honeypot system, wherein the construction method of the request-response table in the honeypot system is as follows:

[0015] S001: Obtain the power industrial control network traffic data under the simulated scenario and store it;

[0016] S002: Filter the valid industrial protocol packet in the power industrial control network traffic data and store the interaction feature field in the valid industrial protocol packet;

[0017] S003: Match the corresponding request-response data field pair using the interaction feature field of the valid industrial protocol packet, and then construct a request-response table of the honeypot system.

[0018] Further preferably, S002 specifically comprises the following steps:

[0019] S0021: Extract the interaction feature fields of each packet in the power industrial control network traffic data stored in the most recent time period. The interaction feature fields include the capture time field Cap_time, the source IP field Src_ip, the destination IP field Dst_ip, the port number field Port in the transport layer, and the industrial control application data unit field PDU in the application layer. The industrial control application data unit field PDU includes the industrial control application data unit function code field Func_code and the industrial control application data unit data field Field_data.

[0020] S0022: Use the Port number field Port and the Function Code field Func_code in the transport layer to filter valid industrial control protocol messages that match the power industrial control scenario to be simulated, and store the interaction feature fields of the valid industrial control protocol messages.

[0021] Further optimization, S003 specifically includes the following steps:

[0022] S0031: Construct an interaction feature field table for valid industrial control protocol messages using the capture time field Cap_time as an index. Each data entry in the interaction feature field table consists of the capture time field Cap_time, the source IP field Src_ip, the destination IP field Dst_ip, the port number field Port in the transport layer, the function code field Func_code of the industrial control application data unit, and the data field Field_data of the industrial control application data unit.

[0023] S0032: Pair the data in the interaction feature field table according to the interaction characteristics of power industrial control equipment to obtain the corresponding request-response data field pairs;

[0024] S0033: Construct a request-response table for the honeypot system using the data from the request-response data field pair, wherein each data entry in the request-response table consists of the industrial control application data unit function code field Func_code, the industrial control application data unit request data field Request_data, and the industrial control application data unit response data field Reply_data.

[0025] Further optimization is achieved by the following pairing rules in S0032: the difference between the Cap_time fields of the two paired messages is less than 1 second, and the message with the smaller Cap_time field value is the Request message, while the message with the larger Cap_time field value is the Reply message; the Src_ip field of the Request message is equal to the Dst_ip field of the Reply message, and the Dst_ip field is equal to the Src_ip field of the Reply message; the Port field values ​​of the two messages are equal, and the Func_code field values ​​are equal.

[0026] Further preferably, the method for responding to attack packets of industrial control network based on the honeypot system further comprises the step of updating the request-response table in the honeypot system, wherein the method for updating the request-response table in the honeypot system is as follows:

[0027] obtaining power industrial control network traffic data in a latest time period and obtaining a new request-response data table according to the power industrial control network traffic data in the latest time period;

[0028] updating the original request-response data table by using the new request-response data table;

[0029] The updating rule is as follows:

[0030] if there is data in the new request-response data table that has repeated fields of the function code of the industrial control application data unit and the request data of the industrial control application data unit with corresponding fields in the original request-response table, then the response data field Reply_data of the industrial control application data unit of the data is used to cover the response data field Reply_data of the industrial control application data unit of the data in the original request-response table;

[0031] if there is data in the new request-response data table that has different fields of the function code of the industrial control application data unit and / or the request data of the industrial control application data unit with corresponding fields in the original request-response table, then the data is inserted into the original request-response table.

[0032] The application further provides a system for responding to attack packets of industrial control network based on the honeypot system, which is used to execute the method for responding to attack packets of industrial control network based on the honeypot system.

[0033] The method and system for responding to attack packets of industrial control network based on the honeypot system provided by the application do not need to change the original network architecture of the power industrial control system, and will not affect the normal operation of the original power industrial control system during deployment. By analyzing real network traffic in various power industry scenarios, a request-response table can be generated. By using the request-response table, a reasonable response with high fraudulence can be returned to the sniffer behavior of the attacker, so as to attract the attacker to attack, capture the information related to the attacker, and improve the interactive response range of the honeypot, increase the difficulty of being identified, and play a greater role in the active defense of the power industrial control system. DETAILED DESCRIPTION

[0034] The application will be further explained in conjunction with specific implementation schemes, but is not limited to the application.

[0035] The application provides an industrial control network attack packet response method based on a honeypot system, comprising the following steps:

[0036] S1: receiving an attack packet and screening an effective industrial control protocol packet in the attack packet;

[0037] The effective industrial control protocol packet can be screened out by matching a port number field Port in an industrial control protocol transmission layer and a network layer industrial control application data unit function code field Func_code.

[0038] S2: extracting an industrial control application data unit function code field Func_code and an industrial control application data unit request data field Request_data from the effective industrial control protocol packet, and matching the corresponding fields of the data in a request response table in the honeypot system, if the same data is matched, S3 is executed, if the extracted industrial control application data unit function code field Func_code is the same as the industrial control application data unit function code field Func_code of multiple data in the request response table, S4 is executed, otherwise, no response is given, wherein the request response table is obtained by analyzing real network traffic in multiple power industry scenarios;

[0039] S3: splicing industrial control application data unit response data field Reply_data of the data matched from the request response table to a response data part to combine a response packet for deceiving an attacker;

[0040] S4: calculating the similarity of the industrial control application data unit request data field Request_data in the effective industrial control protocol packet and the industrial control application data unit request data field Request_data of multiple data matched from the request response table, and splicing the industrial control application data unit response data field Reply_data in the data with the maximum similarity to the response data part to combine a response packet for deceiving an attacker, wherein the similarity is preferably calculated by using a Smith-Waterman algorithm.

[0041] As an improvement of the technical scheme, the industrial control network attack packet response method based on the honeypot system further comprises recording a log of interaction behaviors with an attacker, wherein the log comprises but is not limited to an industrial control application data unit function code sent by the attacker, an attacker IP and PCAP format traffic data record.

[0042] As an improvement of the technical scheme, the industrial control network attack packet response method based on the honeypot system further comprises a step of constructing a request response table in the honeypot system, wherein the construction method of the request response table in the honeypot system is as follows:

[0043] S001: Obtain power industrial control network traffic data under the imitated scene and store;

[0044] In this step, obtaining power industrial control network traffic data under the imitated scene refers to obtaining traffic data under a specific power industrial control network scene to be protected. These real-time traffic data are stored according to a fixed time period. To improve the traffic data processing capability of the honeypot system, preferably, the honeypot system only retains traffic data stored in the latest time period. When complete traffic data of the latest time period are obtained, traffic data of the previous period are overwritten, thereby relieving the pressure of the honeypot system to store data.

[0045] S002: Screen effective industrial control protocol packets in the power industrial control network traffic data and store interaction feature fields in the effective industrial control protocol packets;

[0046] This step specifically includes the following steps:

[0047] S0021: Extract interaction feature fields of each packet in power industrial control network traffic data stored in the latest time period, the interaction feature fields including a capture time field Cap_time, a source IP field Src_ip, a destination IP field Dst_ip, a transmission layer port number field Port, and an industrial control application data unit field PDU in the application layer, wherein the industrial control application data unit field PDU includes an industrial control application data unit function code field Func_code and an industrial control application data unit data field Field_data;

[0048] S0022: Screen effective industrial control protocol packets conforming to the power industrial control scene to be imitated by using the transmission layer port number field Port and the industrial control application data unit function code field Func_code, and store interaction feature fields of the effective industrial control protocol packets;

[0049] The effective industrial control protocol packet is distinguished from a general network protocol packet (such as an arp protocol for finding a mac address), and the packet content focuses on the working state and business logic of an industrial control device. In a specific power industrial control scene, the effective industrial control protocol packet can belong to one protocol or multiple protocol types, but must belong to an industrial control protocol (such as Modbus and IEC104).

[0050] S003: Match corresponding request-response data fields by using the interaction feature fields of the effective industrial control protocol packets, and then construct a request-response table of the honeypot system;

[0051] Specifically, the following steps are included:

[0052] S0031: Construct an interaction feature field table of valid industrial protocol packets with the capture time field Cap_time as the index, wherein each piece of data in the interaction feature field table is composed of the capture time field Cap_time, the source IP field Src_ip, the destination IP field Dst_ip, the transmission layer end port number field Port, the industrial application data unit function code field Func_code, and the industrial application data unit data field Field_data;

[0053] S0032: Pair the data in the interaction feature field table according to the interaction characteristics of the power industrial equipment, to obtain a corresponding request-response data domain pair;

[0054] Wherein, the pairing rule can be as follows: the Cap_time field difference of the two paired packets is less than 1s, and the packet with the smaller Cap_time field value is the Request packet, and the packet with the larger Cap_time field value is the Reply packet; the Src_ip field of the request packet is equal to the Dst_ip field of the response packet, and the Dst_ip field is equal to the Src_ip field of the response packet; the Port field values of the two packets are equal, and the Func_code field values are equal;

[0055] S0033: Construct a request-response table of the honeypot system using the data of the request-response data domain pair, wherein each piece of data in the request-response table is composed of the industrial application data unit function code field Func_code, the industrial application data unit request data field Request_data, and the industrial application data unit response data field Reply_data.

[0056] Since the request-response table constructed by the honeypot system is derived from the real power industrial scene, the response packet returned to the attacker is more deceptive, and the probability of the attacker identifying and marking the honeypot is greatly reduced. The attacker will consider the honeypot system as a real industrial equipment and interact with it deeply, which facilitates the honeypot system to attract malicious attack traffic and record attack behavior.

[0057] The industrial control network attack packet response method based on the honeypot system further comprises the step of updating the request-response table in the honeypot system, wherein the updating method of the request-response table in the honeypot system is as follows:

[0058] Obtain the power industrial network traffic data in the latest time period and obtain a new request-response data table according to the power industrial network traffic data in the latest time period;

[0059] Use the new request-response data table to update the original request-response data table;

[0060] The updating rule is as follows:

[0061] If the new request response data table has the function code field Func_code and the request data field Request_data of the industrial application data unit that are repeated with the corresponding fields in the original request response table, the response data field Reply_data of the industrial application data unit in the new request response data table is used to cover the response data field Reply_data of the industrial application data unit in the original request response table;

[0062] If the new request response data table has the function code field Func_code and / or the request data field Request_data of the industrial application data unit that are different from the corresponding fields in the original request response table, the data is inserted into the original request response table.

[0063] Through the updating of the request response data table, the request response data table can be expanded, the answer set can be increased, the deception performance and the interaction performance of the honeypot system can be enhanced, and the probability of the honeypot system being identified can be reduced.

[0064] The method and system for responding to an industrial control network attack message based on a honeypot system provided by the application can analyze real network traffic in multiple power industry scenarios, imitate the interactive communication content of the power industrial control equipment in a specific scenario, generate a request response table, return a reasonable response with high deception to the sniffer behavior of an attacker by using the request response table, attract the attacker to attack, capture the relevant information of the attacker, improve the interactive response range of the honeypot by extracting the interactive response content that is not specifically defined in the public protocol document in the real industrial control traffic, increase the difficulty of being identified, and make the honeypot play a greater role in the active defense of the power industrial control system.

[0065] The embodiments of the application are described in detail above, but the application is not limited to the above embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the purpose of the application.

Claims

1. A method for responding to an attack packet of an industrial control network based on a honeypot system, characterized in that, The method comprises the following steps: S1: receiving an attack packet and screening valid industrial protocol packets in the attack packet; S2: extracting a corresponding industrial application data unit function code field Func_code and an industrial application data unit request data field Request_data from the valid industrial protocol packet, and matching the corresponding fields of the data in the request response table in the honeypot system, if the same data is matched, S3 is executed, if the extracted industrial application data unit function code field Func_code is the same as the industrial application data unit function code field Func_code of multiple data in the request response table, S4 is executed, otherwise, no response is given; S3: the industrial application data unit response data field Reply_data of the data matched from the request response table is spliced to the response data part to combine a response packet to deceive the attacker; S4: the similarity of the industrial application data unit request data field Request_data in the valid industrial protocol packet and the industrial application data unit request data field Request_data of multiple data matched from the request response table is calculated, and the industrial application data unit response data field Reply_data in the data with the maximum similarity is spliced to the response data part to combine a response packet to deceive the attacker; The construction method of the request response table in the honeypot system is as follows: S001: obtaining real power industrial network traffic data under the power industrial scene to be imitated and storing; S002: screening valid industrial protocol packets in the power industrial network traffic data and storing the interaction feature fields in the valid industrial protocol packets; S003: matching corresponding request response data fields by using the interaction feature fields of the valid industrial protocol packets, and then constructing the request response table of the honeypot system; The industrial network attack packet response method based on the honeypot system further comprises the step of updating the request response table in the honeypot system, and the update method of the request response table in the honeypot system is as follows: Obtaining power industrial network traffic data in the latest time period and obtaining a new request response data table according to the power industrial network traffic data in the latest time period; Updating the original request response data table by using the new request response data table; The update rule is as follows: If the industrial application data unit function code field Func_code and the industrial application data unit request data field Request_data in the new request response data table are repeated with the corresponding fields in the original request response table, the industrial application data unit response data field Reply_data of the data is used to cover the industrial application data unit response data field Reply_data of the data in the original request response table; If the new request response data table has the function code field of the industrial application data unit Func_code and / or the request data field of the industrial application data unit Request_data different from the corresponding fields in the original request response table, the data is inserted into the original request response table.

2. The method of claim 1, wherein the method further comprises: In S1, the valid industrial protocol message is screened out by matching the port number field Port in the industrial protocol transmission layer and the function code field Func_code of the industrial application data unit in the network layer.

3. The method of claim 1, wherein the method further comprises: receiving the attack packet; and determining whether the attack packet is a honeypot attack packet. In S4, the similarity of the request data field Request_data of the industrial application data unit in the valid industrial protocol message and the request data field Request_data of the industrial application data unit in the multiple pieces of data matched from the request response table is calculated by using the Smith-Waterman algorithm.

4. The method of claim 1, wherein the method further comprises: The step of recording the log of the interaction behavior with the attacker is further included.

5. The method of claim 1, wherein the method further comprises: if the attack packet is determined to be a honeypot system attack packet, sending a response packet to the source IP address of the attack packet. S002 specifically includes the following steps: S0021: extracting the interaction feature fields of each message in the power industrial control network traffic data stored in the recent time period, the interaction feature fields including the capture time field Cap_time, the source IP field Src_ip, the destination IP field Dst_ip, the port number field Port in the transmission layer, and the industrial application data unit field PDU in the application layer, wherein the industrial application data unit field PDU includes the function code field Func_code of the industrial application data unit and the data field Field_data of the industrial application data unit; S0022: screening the valid industrial protocol message conforming to the power industrial control scene to be imitated by using the port number field Port in the transmission layer and the function code field Func_code of the industrial application data unit, and storing the interaction feature fields of the valid industrial protocol message.

6. The method of claim 5, wherein the method further comprises: S003 specifically includes the following steps: S0031: constructing the interaction feature field table of the valid industrial protocol message with the capture time field Cap_time as the index, wherein each piece of data in the interaction feature field table is composed of the capture time field Cap_time, the source IP field Src_ip, the destination IP field Dst_ip, the port number field Port in the transmission layer, the function code field Func_code of the industrial application data unit, and the data field Field_data of the industrial application data unit; S0032: pairing the data in the interaction feature field table according to the interaction characteristics of the power industrial control equipment to obtain the corresponding request response data pair; S0033: constructing the request response table of the honeypot system by using the data of the request response data pair, wherein each piece of data in the request response table is composed of the function code field Func_code of the industrial application data unit, the request data field Request_data of the industrial application data unit, and the response data field Reply_data of the industrial application data unit.

7. The method of claim 6, wherein the method further comprises: The pairing rule in S0032 is as follows: the difference between the Cap_time fields of the two paired messages is less than 1s, the Request message has a smaller Cap_time field value, and the Reply message has a larger Cap_time field value; the Src_ip field of the Request message is equal to the Dst_ip field of the Reply message, and the Dst_ip field of the Request message is equal to the Src_ip field of the Reply message; the Port field values of the two messages are equal, and the Func_code field values are equal.

8. The industrial control network attack packet response system based on the honeypot system, characterized in that: The honeypot system-based industrial control network attack message response method of any one of claims 1-7.