A multi-node dynamic trapping system and method for industrial control network

Abstract

The application provides a multi-node dynamic trapping system and method for industrial control network, breaks the disadvantages that traditional honeypot cannot simulate the physical characteristics of industrial control equipment and cannot efficiently trap industrial control attack behaviors, and the basic idea is as follows: in-depth packet analysis is performed on industrial control protocols of different industries and scenes, a multi-node industrial dynamic trapping system is deployed to simulate different industrial control equipment, corresponding feedback is given to the function code request of the attack party, abnormal sessions are trapped, and the trapped suspicious behaviors are real-timely returned to a local database. The application realizes deployment and management of the multi-node industrial dynamic trapping system based on Docker, uses Docker to containerize the industrial dynamic trapping system instance running on a remote server, real-timely reports the running state of the honeypot to a management host, and realizes automatic deployment and monitoring. The dynamic trapping system designed by the application can dynamically scale, and realizes one-key dynamic trapping system deployment and management according to different application scenes and software and hardware resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a multi-node dynamic decoy system and method for industrial control networks. BACKGROUND

[0002] With the rapid development of industrial informatization, industrial control systems (ICS) gradually break the original LAN closed boundaries, and develop towards openness and intelligence. At the same time, the openness of industrial control networks and the backwardness of industrial security defense system lead to frequent security incidents of industrial control systems, affecting the safety of national critical infrastructure. Currently, the industrial-level intrusion detection system (IDS) mainly relies on recording known fingerprint features to passively intercept access sessions. This interception mode is helpless against zero-day vulnerabilities and advanced persistent threats (APTs). Honeypot is a kind of active defense technology introduced by the defense party to change the asymmetric situation of network attack and defense game. By deploying security resources without business use, it lures attackers to use it illegally, so as to capture and analyze the attack behavior, understand the attack tools and methods, and speculate the attack intention and motive. Honeypot technology has won the continuous attention of the security community, and has been widely developed and applied, and has become a main technical means for monitoring and analyzing Internet security threats.

[0003] In recent years, the threat analysis and intrusion protection method based on honeypot has attracted widespread attention in the security field, and the invention patents related to honeypot have also developed rapidly.

[0004] The invention patent with application number CN101185063A discloses a system and method for detecting and blocking attacks using honeypot. According to some embodiments of the invention, it provides a system and method for protecting an application from attacks. In some examples of the invention, an anomaly detection component receives a message from a communication network. The anomaly detection component monitors the received message and routes the communication to a protected application or to a honeypot, where the honeypot is in the same state information as the protected application. If the received communication is routed to the honeypot, the honeypot monitors the communication to discover attacks. If an attack occurs, the honeypot repairs the protected application. The honeypot system of the patent invention is not isolated from the real physical network, and the attacker can easily use the honeypot as a stepping stone to invade the real physical network.

[0005] The application number CN107819731A discloses a network security protection system and related method. The network security protection system comprises at least one boundary honeypot and a honeynet connected with the at least one boundary honeypot; wherein: the at least one boundary honeypot is located in a business network, and the at least one honeynet is isolated from the business network; the at least one boundary honeypot is used to induce an attacker to attack itself and guide the attacker to enter the connected honeynet. The application induces the attacker to attack the boundary honeypot and further guides the attacker to enter the honeynet from the boundary honeypot. Since the honeynet is isolated from the business network, compared with the prior art, on one hand, the boundary honeypot and the honeynet can induce and deceive the attacker, whether the attack mode is known or unknown, more effective defense can be realized, at the same time, the attack time of the attacker is delayed, the attack path of the attacker is changed, and the attack of the attacker on the normal business network is timely blocked. The application can only simply reply to the request message of the attacker, the honeypot has poor disguise, and the attacker can easily identify the response behavior of the honeypot.

[0006] The application number CN202010805588.3 discloses a high-interaction honeypot system and a honeypot protection method. The high-interaction honeypot system comprises a honeypot service module and a proxy module. The honeypot service module is arranged in a container and / or a virtual machine and is used to provide honeypot services. The honeypot service module and the proxy module are isolated from each other. The proxy module comprises a message transmission port, a parser and an encoder which are coupled in sequence. The parser and the encoder are coupled with the honeypot service module. The message transmission port is used to transmit messages between a client and the honeypot service module. The parser is used to parse messages according to a preset parsing format. The encoder is used to encode the parsed messages according to a preset encoding format. The messages comprise request messages sent to the honeypot service module and response messages sent to the client. The patent cannot guarantee that the attack data captured by the honeypot can be transmitted back to the local disk storage in real time, and the honeypot access record is easy to be erased by the attacker.

[0007] The application patent with the application number 201810323236.7 discloses an industrial control data ferry system, relating to the technical field of industrial data ferry security, comprising: a terminal device, a protocol filtering device, an industrial control isolation gateway, a first industrial control firewall, a first switch and a first industrial control encryptor; the protocol filtering device is connected with the industrial control isolation gateway, used for checking whether the application layer protocol used by the data packet is safe; the industrial control isolation gateway is connected with the first switch, used for safely transmitting the data packet; the first industrial control firewall is connected with the first switch, used for checking whether the application layer and network layer protocols used by the data packet are safe; and the first industrial control encryptor is connected with the first industrial control firewall, used for encrypting the application layer data in the data packet. The technical problem that the industrial control data ferry is easily attacked by attackers to carry viruses or malicious behaviors in the prior art is solved, and it is ensured that the attack can be blocked. The patent is similar to an industrial firewall, which can only check whether the communication data packet conforms to the protocol specification, and cannot trap malicious attack behaviors in the industrial field.

[0008] In general, the above-mentioned honeypot-based trapping system protects the information system to a certain extent, but has the following problems:

[0009] 1. Lack of honeypot trapping system and method for industrial control network.

[0010] Due to the complex scene of industrial control system, the large difference in function of the controller, and the multiple communication protocols, the trapping technology for industrial control network has not been widely used. Most of the currently disclosed trapping systems are honeypot systems for traditional networks. Due to the differences in control protocols and physical environment, the existing honeypot system based on traditional network is difficult to be applied to industrial control network.

[0011] 2. Lack of effective and dynamically expandable industrial control honeypot system

[0012] Most of the existing industrial control network honeypot systems simulate a single industry-specific production process and cannot dynamically simulate multiple industrial control protocols in multiple industries in different scenes, so that the attack behavior data captured is too single. In addition, the existing method is difficult to efficiently simulate the real industrial production process, so that the simulation degree and concealment of the honeypot cannot achieve the ability to confuse and trap attackers.

[0013] 3. Lack of one-key deployment and management capability

[0014] Most of the current honeypot systems need to be configured and deployed by professional security personnel, and need to be maintained and managed by professional personnel, lacking the necessary ease of use and friendliness in the honeypot deployment and management process. SUMMARY

[0015] The object of the present application is to overcome the shortcomings of the prior art, and a multi-node dynamic trapping system and method for industrial control network are designed and implemented. The system can capture abnormal network sessions of different industrial control systems by synchronously simulating multiple industrial control protocols, and can realize attack behavior capture and security situation awareness under different geographical spans. The basic idea is: in-depth packet analysis of industrial control protocols in different industries and scenarios, deployment of a multi-node industrial dynamic trapping system to simulate different industrial control devices, respond to the attacker's function code request, capture abnormal sessions, and return the trapped suspicious behavior to the local database in real time. At the same time, the patent realizes the deployment and management of the multi-node industrial dynamic trapping system based on Docker. The industrial dynamic trapping system running on the remote server is containerized using Docker, and the running status of the honeypot is reported to the management host in real time, realizing automatic deployment and monitoring. The dynamic trapping system designed in this patent can dynamically scale, and can realize one-key dynamic trapping system deployment and management according to different application scenarios and hardware and software resources.

[0016] To achieve the above-mentioned application object, the technical scheme provided by the present application is:

[0017] A multi-node dynamic trapping system for industrial control network, characterized in that it comprises:

[0018] A network session unit: mainly responsible for maintaining dynamic trapping nodes and abnormal sessions of attackers on different network ports, processing requests and responses by sockets on the corresponding ports. Then, the application protocol data unit (APDU) data in the corresponding TCP packet is allocated to the lower layer corresponding protocol analysis and packet generation unit, and the response message of the lower layer module is waited, and then encapsulation and sending are performed. After the session ends, the connection is closed.

[0019] A protocol analysis and packet generation unit: the most important unit in the dynamic trapping system, which instantiates the corresponding protocol server according to the industrial communication protocol used by the simulated industrial control device of the honeypot node to process the packet, and verifies the instruction. For industrial control instruction packets, the module reads and writes the data in the data area of the template to realize dynamic analysis and behavior capture of different scenes and application control protocols.

[0020] A data storage unit: records the packet log analyzed by the protocol analysis and packet generation module, writes the data into a relational database or a non-relational database according to the captured data format, and triggers a no-copy ultra-fast full-network IP scanning and IP reputation database query module to mark and trace the abnormal access IP.

[0021] Template setting data area unit: the template setting data area unit stores the state information of the industrial control device simulated by different nodes of the dynamic trapping system, including device name, number, soft and hard identification, factory configuration and other unmodifiable information and voltage value, temperature value, liquid level value and other modifiable state information. There is only one copy of the template configuration data on each node to maintain the persistence and consistency of data modification, and different nodes simulate different industry and scene physical process and production state.

[0022] Data backhaul unit: the most ideal implementation of the dynamic trapping system is deployed on a cloud server, and the information scanned by the copy-free super-speed full-network IP scanning module is mainly stored in the enterprise internal network. The internal network communication address is invisible to the dynamic trapping system. The patent uses a message queue to maintain a persistent connection between the cloud and the enterprise internal network, ensuring that the dynamically captured log data can be transmitted to the local database in real time.

[0023] Further according to the above multi-node honeypot dynamic trapping system for industrial control network, characterized in that the network session unit, in the case of no contradiction in port occupation, a single honeypot node can simulate multiple industrial control devices. Among them, the design of the industrial control communication protocol requires that a specific industrial control communication protocol must use a specific port. Therefore, the network session unit first creates a socket service according to the list of industrial control protocol ports used by the simulated industrial control device. The network session unit mainly includes a session management component and an attack session component, which are in an aggregate relationship. The Session Manager module acts as a service provider for the dynamic trapping node and needs to maintain a permanent background running state. When instantiated, it calls fork to copy the process space of the parent process, and then ends the parent process, so that the child process becomes a daemon process. The session management uses an epoll-based multiplexing mechanism. When there is a new session on the above-mentioned port, it will trigger the instantiation of the attack session (Attack Session) to maintain the current abnormal session, record the protocol stack information, source IP, source port, destination IP, destination port, timestamp, and the properties of the session, including device configuration and state information.

[0024] Further according to the above multi-node honeypot dynamic trapping system for industrial control network, characterized in that the protocol analysis and message generation unit gives a message analysis and response generation scheme for ModusBus, Bacnet, S7, IEC104, Guardian and Kamstrup six kinds of industrial control communication protocols widely used in industrial control field, and designs a unified interface specification for the above six kinds of industrial control protocols.

[0025] (i) The ModbusServer adopts a master-slave design pattern, and the master node receives the application layer message parsed by the network session module. When the ModbusServer is initialized, the corresponding slave node and attribute information are registered for the master node according to the attribute configuration table of the Config Databus.

[0026] (ii) The KamstrupServer also adopts a master-slave design pattern. The Master node exclusively occupies the 1025 port of the node, and the slave node occupies the 50100 port. The slave node independently receives and parses messages and executes corresponding instructions.

[0027] (iii) The S7Server follows a server / client mode. Therefore, the S7Server only needs to implement server functions to provide services for attackers. The S7Server only allows a single device to be mounted, and additional TPKT decoding and COPT decoding are required for the message. The order is reversed when encapsulating the S7 response message.

[0028] (iv) The BacnetServer is based on objects. In an industrial control device, it is an instantiation object of the monitored component device. The object list of the monitored component device is maintained to manage the monitored device.

[0029] (v) The IEC140Server must consider encapsulating and decoding the data segment in one of the "I", "S", and "U" modes when sending and receiving messages. The legality of the parsed instructions in the message is verified according to the three different states.

[0030] (vi) The GuardianServer follows a server / client working mode. The GuardianServer only needs to provide a vulnerable service to attract attackers to scan and sniff the service.

[0031] Further according to the above multi-node honeypot dynamic trapping system for industrial control network, the data storage unit stores the parameter information of the real industrial control device initialized by each honeypot instance in the product and use scenario by using a relational database; stores the request and response information received by each honeypot instance by using a non-relational database; stores the parent-child containing relationship of the industrial product information parameter information by using an XML document object template, and simultaneously simulates multiple honeypot instances of the same device sharing the same XML information table.

[0032] Further according to the multi-node honeypot dynamic trapping system for industrial control network, in order to ensure that the dynamic trapping system node returns the captured attack log data in real time, a RabbitMQ message queue is used to connect the cloud dynamic trapping system node with the local internal network, so that the attack log data captured by the industrial honeypot deployed on the cloud server is returned to the local database in real time, and the data return operation is triggered by each distributed honeypot node. The honeypot node and the internal host establish a TCP connection with the RabbitMQ service respectively, when the honeypot node generates new log data, the data is directly sent to the data queue through the connection, and the RabbitMQ pushes the data to the internal host. The honeypot node and the internal host actively initiate connection to the RabbitMQ server, which can solve the problem of invisible local internal IP, and the message queue using the publisher-subscriber mode realizes real-time data return.

[0033] Further according to the multi-node honeypot dynamic trapping system for industrial control network, in order to more effectively confuse the attacker, the honeypot node can simulate the production process characteristics of the industrial control equipment, and the template setting data area sets the state information of the industrial control equipment simulated by the honeypot node, including unmodifiable information such as device name, number, manufacturer, and voltage value, and modifiable state information such as remaining oil amount. There is only one template configuration data on a node to maintain the persistence and consistency of data modification.

[0034] A multi-node honeypot dynamic trapping method for industrial control network, comprising the following steps:

[0035] Step (1), constructing a network session. Abnormal sessions of the dynamic trapping node and the attacker are maintained on different network ports, and the requests and responses are processed by the socket on the corresponding port. Then the application protocol data unit (APDU) data in the corresponding TCP packet is allocated to the corresponding protocol analysis and packet generation module in the lower layer, and the response message of the lower layer module is waited, and then encapsulation and sending are performed, and the connection is closed after the session is ended;

[0036] Step (2), industrial control protocol analysis and simulation, six industrial control communication protocols ModusBus, Bacnet, S7, IEC104, Guardian and Kamstrup widely used in industrial control field are analyzed, and a unified interface specification is designed for the above six industrial control protocols. Honeypot nodes of different industries and scenes are deployed in the cloud server to simulate the above six commonly used industrial control protocols, and the industrial production process is simulated, different industrial control instruction packets are dynamically analyzed, and dynamic analysis and malicious behavior capture of different scene and application control protocols are realized.

[0037] Step (3), industrial control device state information setting. In order to improve the concealment and deception of the honeypot node, the template sets the state information of the industrial control device simulated by the honeypot node in the data area, including the device name, number, manufacturer and other unmodifiable information and voltage value, residual oil amount and other modifiable state information. There is only one template configuration data on a node to maintain the persistence and consistency of data modification.

[0038] Step (4), attack log real-time return. The rabbitMQ message queue is used to build the connection between the cloud honeypot node and the local internal network, and the attack log data captured by the industrial honeypot deployed on the cloud server is returned to the local database storage in real time, and the data return operation is triggered by each distributed honeypot node. The honeypot node and the internal network host establish a TCP connection with the RabbitMQ service respectively, when the honeypot node generates new log data, the data is sent to the data queue directly through the connection, and the internal network host is pushed by RabbitMQ. The honeypot node and the internal network host respectively initiate connection to the RabbitMQ server, and the message queue using the publisher-subscriber mode realizes real-time data return.

[0039] Step (5), data storage. The product and parameter information of the real industrial control device initialized by each honeypot instance are stored by using a relational database; the request and response information received by each honeypot instance are stored by using a non-relational database; the upper and lower containing relationship of the industrial product information parameter information is stored by using an XML document object template, and multiple honeypot instances of the same device share the same XML information table. Among them, the function code request and the corresponding response dynamically received by the honeypot instance from the attacker are important attack evidence information, and are the core data of the multi-node dynamic trapping system.

[0040] The multi-node honeypot dynamic trapping system for industrial control network described in the application is deployed on the Internet, between the user and the industrial control network.

[0041] The beneficial effects of the application are:

[0042] 1), the application breaks the limitation of most honeypot systems which pay excessive attention to traditional networks, constructs a multi-node honeypot trapping system with high interaction and dynamics by deeply analyzing industrial control protocols of different industries, receives the communication request of the attacker in real time, effectively extracts the function code and operation code in the request message, and returns the corresponding response information to the attacker with high deception, so as to effectively capture the malicious attack behavior log of the attacker. At the same time, the deployed multi-node honeypot dynamic trapping system can redirect the malicious attack flow to a virtual industrial control network without actual industrial production, and can effectively protect the safety of the real industrial control production environment.

[0043] 2), The application respectively gives the message analysis and response generation scheme of ModusBus, Bacnet, S7, IEC104, Guardian and Kamstrup 6 kinds of industrial control communication protocols widely used in industrial control field, and designs a unified interface specification for the above-mentioned 6 kinds of industrial control protocols, so that the plug-in type industrial control protocol dynamic expansion can be realized, and flexible elastic configuration and management can be carried out according to different industries, application scenes and hardware and software resources.

[0044] 3), The application utilizes the message queue to construct the real-time communication of the cloud dynamic trapping node and the enterprise internal network, realizes that when the cloud honeypot node is accessed by the attacker, the enterprise internal network can write the attack log into the local disk in real time, so that even if the attacker erases the access record of the honeypot, the enterprise internal network can still record the attack behavior log data of the attacker in real time.

[0045] 4), The application utilizes the Docker container technology, containerizes the honeypot system containers simulating different industries and generation scenes, and one-key deploys the required honeypot by instantiating different container instances according to different requirements, so that the multi-node honeypot dynamic trapping system can be one-key deployed and managed.

[0046] 5), The sample machine use practice proves that the application can effectively capture malicious attack behaviors for different industries, and the scheme has the advantages of easy arrangement in existing network, simple operation, safety and reliability, and has significant economic and social benefits and broad market application prospect. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 It is a general architecture block diagram of the multi-node honeypot dynamic trapping system for industrial control network according to the application;

[0048] Figure 2 It is a data back transmission framework based on the message queue;

[0049] Figure 3 It is a multi-node honeypot management framework based on the Docker container; DETAILED DESCRIPTION

[0050] The technical scheme of the application is described in detail in combination with the drawings, so that those skilled in the art can more clearly understand the scheme of the application, but the protection scope of the application is not limited thereto.

[0051] Industrial control system (ICS) is an important part of realizing industrial automation production and management, which is widely used in energy, transportation, power, national defense and other key basic fields. With the deep integration of industrialization and informatization, more and more industrial control devices and systems are exposed to the open Internet environment, and the industrial Internet is gradually moving from single machine to interconnection, from closed to open, from automation to intelligent, and the network space and the industrial physical space are increasingly integrated. Since the devices and communication protocols used by industrial control systems are not designed to access the Internet at the beginning, they pay more attention to efficiency and ignore security. When these industrial devices and networks with potential security threats are connected to the Internet, the industrial control system and devices are exposed to a large number of security threats. The industrial control network composed of industrial control devices is related to the important guarantee of economy and life of a country or region, and it is becoming the target of hackers, especially hostile forces.

[0052] In fact, industrial control network attacks are more harmful than traditional network attacks, mainly in the following aspects: first, compared with the aimless traditional virus attack, the industrial control network attack has clear direction and purpose; second, unlike the relatively isolated traditional network attack, the industrial control network attack emphasizes coordinated operations, is organized, planned and has higher attack technology;

[0053] Firstly, the technical innovation principle of the present application is explained, and the basic idea is as follows: the industrial control protocols of different industries and scenes are deeply packet analyzed, and different industrial control devices are simulated by deploying a multi-node industrial dynamic trapping system. The simulated industrial control devices artificially expose a certain number of vulnerable points to attract attackers to scan and attack, so as to identify the function code request and operation code request of the communication request sent by the attacker, and make corresponding feedback operation on these requests, capture abnormal sessions and trap suspicious attack behaviors. Then the malicious attack log captured by the honeypot system is returned to the local database storage and analysis in real time through the message queue. At the same time, the present application realizes the deployment and management of the multi-node industrial dynamic trapping system based on Docker. Docker is used to containerize the industrial dynamic trapping system instance running on the remote server, and one-key dynamic trapping system deployment and management are realized according to different application scenes and software and hardware resources, which can effectively realize the dynamic scaling of the honeypot system. The multi-node honeypot dynamic trapping system designed in the present application can capture industrial network attacks in different industries and scenes in real time, and can effectively perceive the security situation inside the industrial control system.

[0054] The structure principle and working process of the multi-node honeypot dynamic trapping system for industrial control network according to the present application will be described in detail below with reference to the accompanying drawings, and the preferred embodiments include the following.

[0055] Preferred embodiments

[0056] As Figure 1 shown, as a first preferred embodiment, the multi-node dynamic trapping system for industrial control network according to the present application comprises a network session unit, a protocol analysis and message generation unit, a data storage unit, a data back transmission unit, and a template setting data area unit. The abnormal session unit is connected to the protocol analysis and message generation unit and the template setting data area unit; the protocol analysis and message generation unit is connected to the data back transmission unit; and the data back transmission unit is connected to the data storage unit.

[0057] The network session unit can simulate multiple industrial control devices on a single honeypot node without port conflict. The design of the industrial control communication protocol requires that a specific industrial control communication protocol must use a specific port. Therefore, the network session module first creates a socket service according to the list of industrial control protocol use ports of the simulated industrial control device. The network session module mainly includes a session management component and an attack session component, which are in an aggregate relationship. The session management (Session Manager) component, as a service provider of the dynamic trapping node, needs to maintain a permanent background running state, calls the fork process to copy the process space of the parent process when it is instantiated, and then ends the parent process to make the child process a daemon process. The session management uses an epoll-based multiplexing mechanism. When there is a new session on the above-mentioned port, the session management instantiates the attack session to maintain the current abnormal session, records the protocol stack information, source IP, source port, destination IP, destination port, timestamp, and other session attribute information such as device configuration and state information.

[0058] The protocol analysis and message generation unit gives a message analysis and response generation scheme for Modbus, Bacnet, S7, IEC104, Guardian, and Kamstrup, which are widely used in the field of industrial control, and designs a unified interface specification for the above-mentioned six industrial control protocols.

[0059] (1) The ModbusServer adopts a master-slave design mode. The master node receives the application layer message parsed by the network session module. When the ModbusServer is initialized, the master node is registered with the corresponding slave node and attribute information according to the attribute configuration table of the Config Databus.

[0060] (ii) The KamstrupServer also adopts the master-slave design pattern. The Master node exclusively occupies the 1025 port of the node, and the slave node 50100 port independently receives message analysis and executes corresponding instructions.

[0061] (iii) The S7Server follows the server-client mode. Therefore, S7Server only needs to implement server functions to provide services for attackers. S7Server only allows a single device to be mounted, and needs to perform additional TPKT decoding and COPT decoding on messages. The order is reversed when encapsulating S7 response messages.

[0062] (iv) The BacnetServer is based on objects. In industrial control devices, it is the instantiation of component devices that are monitored to implement objects. The object list of the monitored component devices is maintained to manage the monitored devices.

[0063] (v) The IEC140Server must consider encapsulating and decoding data segments in one of the "I", "S", and "U" modes when sending and receiving messages. The legality of the instructions parsed from the message is verified according to the three different states.

[0064] (vi) The GuardianServer follows the server / client working mode. GuardianServer only needs to provide services with vulnerabilities to attract attackers to scan and sniff the services.

[0065] The data storage unit stores the product and use scenario parameter information of the real industrial control device initialized by each honeypot instance using a relational database; stores the request and response information received by each honeypot instance using a non-relational database; stores the parent-child containing relationship of the industrial control product information parameter information using an XML document object template, and simulates multiple honeypot instances of the same device sharing the same XML information table.

[0066] The data back transmission unit is used to ensure real-time back transmission of the captured attack log data of the dynamic trapping system node, and is used to connect the cloud dynamic trapping system node and the local internal network by using a rabbitMQ message queue, so that the attack log data captured by the industrial honeypot deployed on the cloud server is transmitted to the local database in real time, and the data back transmission operation is triggered by each distributed honeypot node. The honeypot node and the internal network host establish a TCP connection with the RabbitMQ service respectively, and when the honeypot node generates new log data, the data is directly sent to the data queue through the connection, and the RabbitMQ pushes the data to the internal network host. The honeypot node and the internal network host actively initiate connection to the RabbitMQ server, which can solve the problem of invisible local internal network IP, and the message queue in the publisher-subscriber mode is used to realize real-time data back transmission.

[0067] The template setting data area unit is used to more effectively confuse the attacker, and the honeypot node can simulate the production process characteristics of the industrial control equipment. The template setting data area sets the state information of the industrial control equipment simulated by the honeypot node, including unmodifiable information such as device name, number, manufacturer and voltage value, and modifiable state information such as remaining oil amount. There is only one template configuration data on a node to maintain the persistence and consistency of data modification.

[0068] In this way, on the Internet where the multi-node honeypot dynamic trapping system for industrial control network is arranged, if an attacker scans, detects or attacks the multi-node honeypot dynamic trapping system, the honeypot dynamic trapping system receives the communication request sent by the attacker and establishes an abnormal session, extracts the function code and operation code of the communication request, and feeds back the corresponding information to the attacker to achieve the purpose of cheating the attacker. At the same time, the dynamic trapping system submits the established abnormal session to the message queue, and the malicious attack behavior captured by the honeypot system can be transmitted to the local server in real time, so as to permanently save the attack behavior log of the attacker and provide data support for subsequent attack tracing and attack mode extraction. At the same time, the multi-node honeypot dynamic trapping system can redirect the attack traffic to the honeypot system, which can effectively protect the real industrial control network and system.

[0069] A multi-node honeypot dynamic trapping method for industrial control network, comprising the following steps:

[0070] Step (1), constructing a network session. The abnormal session of the dynamic trapping node and the attacker is maintained on different network ports, and the request and response are processed by the socket on the corresponding port. Then, the application protocol data unit (APDU) data in the corresponding TCP packet is allocated to the corresponding protocol analysis and packet generation module in the lower layer, and the response message of the lower layer module is waited, and then the encapsulation and sending are performed, and the connection is closed after the session is ended;

[0071] Step (2), industrial protocol analysis and simulation, ModusBus, Bacnet, S7, IEC104, Guardian and Kamstrup 6 kinds of industrial control communication protocols are widely used in industrial control field, and a unified interface specification is designed for the above 6 kinds of industrial control protocols. In the cloud server, the honeypot nodes of different industries and scenes are deployed to simulate the above 6 kinds of commonly used industrial control protocols, and the industrial production process is simulated, the different industrial control instruction messages are dynamically analyzed, and the dynamic analysis and malicious behavior capture of different scene and application control protocol are realized.

[0072] Step (3), industrial control device state information setting. In order to improve the concealment and confusion of the honeypot node, the template setting data area sets the state information of the industrial control device simulated by the honeypot node, including the device name, number, manufacturer and other unmodifiable information and voltage value, remaining oil quantity and other modifiable state information. There is only one template configuration data on a node to maintain the persistence and consistency of data modification.

[0073] Step (4), attack log real-time backhaul. RabbitMQ message queue is used to build the connection between cloud honeypot node and local internal network, and the attack log data captured by the industrial honeypot deployed on the cloud server is real-time backhauled to the local database storage, and the data backhaul operation is triggered by each distributed honeypot node. The honeypot node and the internal network host establish TCP connection with the RabbitMQ service respectively, when the honeypot node generates new log data, directly sends the data to the data queue through the connection, and the RabbitMQ pushes the data to the internal network host. The honeypot node and the internal network host respectively initiate connection to the RabbitMQ server, and the message queue using publisher-subscriber mode realizes real-time data backhaul.

[0074] Step (5), data storage. The relational database is used to store the product and parameter information of the real industrial control device initialized by each honeypot instance under the use scene; the non-relational database is used to store the request and response information received by each honeypot instance; the XML document object template is used to store the upper and lower containing relationship of the industrial product information parameter information, and the same device of multiple honeypot instances is simulated to share the same XML information table. Among them, the function code request and the corresponding response dynamically received by the honeypot instance from the attacker are important attack evidence information, which are the core data of the multi-node dynamic trapping system.

[0075] The application provides a multi-node dynamic trapping system and method for industrial control network, which breaks the disadvantages of traditional honeypot, i.e., unable to simulate the physical characteristics of industrial control equipment and unable to efficiently trap industrial control attack behaviors. The basic idea is as follows: in-depth packet analysis is performed on industrial control protocols of different industries and scenes, a multi-node industrial dynamic trapping system is deployed to simulate different industrial control equipment, corresponding feedback operations are performed on the function code request of the attack party, abnormal sessions are trapped, and the trapped suspicious behaviors are real-timely returned to a local database for storage. Meanwhile, the patent realizes deployment and management of the multi-node industrial dynamic trapping system based on Docker, uses Docker to containerize the industrial dynamic trapping system instance running on a remote server, real-timely reports the running state of the honeypot to a management host, and realizes automatic deployment and monitoring. The dynamic trapping system designed by the patent can dynamically scale, and realizes one-key dynamic trapping system deployment and management according to different application scenes and hardware and software resources.

[0076] The above only describes the preferred embodiments of the application, and does not limit the technical solutions of the application to this, and any known modification made by the person skilled in the art on the basis of the main technical concept of the application belongs to the technical category to be protected by the application, and the specific protection range of the application is subject to the description in the claims.

Claims

1. A multi-node dynamic trapping system for industrial control networks, characterized in that, The network session unit, the protocol analysis and message generation unit, the data storage unit, the data return unit, and the template setting data area unit are included. The network session unit is mainly responsible for maintaining dynamic honeypot nodes and abnormal sessions of attackers on different network ports, and handles requests and responses through sockets on the corresponding ports; then, application protocol data unit (APDU) data in the corresponding TCP message is allocated to the corresponding protocol analysis and message generation module in the lower layer, and the response message of the lower layer module is waited for, and then encapsulation and sending are performed, and the connection is closed after the session ends; in the case that port occupation is not contradictory, multiple industrial control devices are simulated on a single honeypot node; wherein, the design requirements of the industrial control communication protocol itself require that the corresponding industrial control communication protocol must use the corresponding port; therefore, the network session unit first creates a socket service according to the industrial control communication protocol port list used by the simulated industrial control device; the network session unit mainly includes a session management module and an attack session module, and the two are in an aggregated relationship; the session management (Session Manager) module serves as a service provider of the dynamic honeypot node, needs to maintain a permanent background running state, calls the fork process to copy the process space of the parent process when being instantiated, and then ends the parent process, so that the child process becomes a daemon process; the session management uses an epoll-based multiplexing mechanism, when there is a new session on the above-mentioned port, the session management instantiates the attack session (Attack Session) to maintain the current abnormal session, records the protocol stack information, source IP, source port, destination IP, destination port, timestamp, and the attribute information of the session, including the device configuration and state information used. The protocol analysis and message generation unit gives a message analysis and response generation scheme for ModBus, Bacnet, S7, IEC104, Guardian and Kamstrup six industrial control communication protocols in the field of industrial control, and designs a unified interface specification for the above six industrial control communication protocols; ModbusServer adopts master-slave design mode, the master node receives the application layer message parsed by the network session unit, when ModbusServer is initialized, the corresponding slave node and attribute information are registered for the master node according to the attribute configuration table of ConfigDatabus; The KamstrupServer also adopts master-slave design mode, the Master node monopolizes the 1025 port of the node, the slave node 50100 port, independently receives message analysis and executes corresponding instructions; S7Server follows the server and client mode, so S7Server only needs to realize the server function to provide services for attackers, S7Server only allows to mount a single device, needs to perform additional TPKT decoding and C0PT decoding, and the order is reversed when encapsulating S7 response message; The BacnetServer is based on object, which is the instantiation object of the monitored component device in the industrial control device, and the object list of the monitored component device is maintained to manage the monitored device; The IEC140Server must consider the encapsulation and decoding of the data segment in one of the "I", "S", "U" three modes when sending and receiving messages, and verify the legality of the parsed instructions in the message according to the three different states; The unit instantiates the corresponding protocol server according to the industrial control communication protocol used by the industrial control device simulated by the honeypot node to process the message and verify the instruction; For industrial control communication protocol instruction message, the module reads and writes the data in the data area of the template to realize dynamic analysis and behavior capture of different scenes and application industrial control communication protocol.

2. The multi-node dynamic trapping system for industrial control network according to claim 1, characterized in that, The data storage unit stores the parameter information of the real industrial control device initialized by each honeypot instance in the product and use scene by using a relational database; The request and response information received by each honeypot instance is stored by using a non-relational database; The XML document object template is used to store the upper and lower containing relationship of the industrial control communication protocol product information parameter information, and multiple honeypot instances of the same device are simulated to share the same XML information table.

3. The multi-node dynamic trapping system for industrial control network according to claim 1, wherein, In order to ensure that the dynamic trapping system node real-time backhaul captured attack log data, the data backhaul unit adopts rabbitMQ message queue to build cloud dynamic trapping system node and local internal network connection, and the attack log data captured by the industrial honeypot deployed on the cloud server is real-time backhauled to the local database storage, and the data backhaul operation is triggered by each distributed honeypot node; the honeypot node and the internal network host establish TCP connection with the RabbitMQ service respectively, when the honeypot node generates new log data, directly sends the data to the data queue through the connection, and pushes the data to the internal network host by RabbitMQ; the honeypot node and the internal network host respectively initiate connection to the RabbitMQ server, solve the problem of local internal network IP invisibility, and use the publisher-subscriber mode message queue to realize real-time data backhaul.

4. The multi-node dynamic trapping system for industrial control network according to claim 1, characterized in that, In order to more effectively confuse the attacker, the honeypot node can simulate the production process characteristics of the industrial control equipment, the template setting data area unit sets the state information of the industrial control equipment simulated by the honeypot node, including device name, number, manufacturer, non-modifiable information and voltage value, and remaining oil volume modifiable state information; there is only one template configuration data on a node to maintain the persistence and consistency of data modification.

5. A multi-node dynamic luring method for an industrial control network, characterized in that, The method comprises the following steps: Step (1), constructing network session; Maintain abnormal session of dynamic trapping node and attacker on different network ports, process request and answer by socket on corresponding port; then allocate application protocol data unit (APDU) data in corresponding TCP message to corresponding protocol analysis and message generation module in lower layer, wait for answer message of lower layer module, then encapsulate and send, close connection after session ends; Step (2), industrial control communication protocol analysis and simulation, analyze ModBus, Bacnet, S7, IEC104, Guardian and Kamstrup six kinds of industrial control communication protocols applied in industrial control field, and design unified interface specification for the above six kinds of industrial control communication protocols; deploy honeypot nodes of different industries and scenes in cloud server to simulate the above six kinds of commonly used industrial control communication protocols, and simulate their industrial production process, dynamically analyze different industrial control communication protocol instruction messages, realize dynamic analysis and malicious behavior capture of different scenes and application industrial control communication protocols; Step (3), industrial control equipment state information setting; in order to improve the concealment and confusion of the honeypot node, the template setting data area sets the state information of the industrial control equipment simulated by the honeypot node, including device name, number, manufacturer, non-modifiable information and voltage value, and remaining oil volume modifiable state information; there is only one template configuration data on a node to maintain the persistence and consistency of data modification; Step (4), attack log real-time backhaul; the rabbitMQ message queue is adopted to build the connection between the cloud honeypot node and the local internal network, the attack log data captured by the industrial honeypot deployed on the cloud server is real-time backhauled to the local database storage, and the data backhaul operation is triggered by each distributed honeypot node; the honeypot node and the internal network host establish TCP connection with the RabbitMQ service respectively, when the honeypot node generates new log data, the data is directly sent to the data queue through the connection, and the RabbitMQ pushes the data to the internal network host; the honeypot node and the internal network host respectively actively initiate connection to the RabbitMQ server, and the message queue of the publisher_subscriber mode is used to realize real-time data backhaul; Step (5), data storage; the product and parameter information of the real industrial control device initialized by each honeypot instance are stored by using a relational database; the request and response information received by each honeypot instance is stored by using a non-relational database; the upper and lower containing relationship of the industrial control communication protocol product information parameter information is stored by using an XML document object template, and meanwhile, multiple honeypot instances of the same device share the same XML information table are simulated; wherein, the function code request and the corresponding response in real time and dynamically received by the honeypot instance from the attacker are important attack evidence information, and are the core data of the multi-node dynamic trapping system.

Images