Attack test method, device and equipment of industrial control network and storage medium

Abstract

The invention discloses an attack test method and device for an industrial control network, equipment and a storage medium, and the method comprises the steps: obtaining current network nodes under a current level of the industrial control network, and network security vulnerabilities corresponding to the current network nodes, carrying out the attack test for each network security vulnerability, and obtaining an attack test result; security analysis is carried out on the industrial control network based on the attack test result; determining a network penetration vulnerability capable of being used for acquiring administrator permission in the network security vulnerabilities, and acquiring a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs according to the administrator permission obtained by attacking the network penetration vulnerability; and taking the lower-layer network node as the current network node, and returning to execute the operation of obtaining the network security vulnerabilities corresponding to each current network node until the network penetration vulnerabilities capable of being used for obtaining the administrator authority do not exist in the network security vulnerabilities, so that comprehensive attack testing can be performed on the industrial control network. And the security of the industrial control network is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack test method, device, equipment and storage medium for an industrial control network. Background Art

[0002] At present, in order to ensure the safe and stable operation of industrial control networks and prevent intrusion into important areas of industrial control networks from external networks and internal non-important networks, it is usually necessary to conduct attack tests on industrial control networks.

[0003] In the prior art, assets within an industrial control network are usually scanned using automated tools to detect known network security vulnerabilities, and attack tests are performed on each network security vulnerability based on different user intentions.

[0004] However, with the increasing complexity of modern industrial environments, the architecture of industrial control networks often presents a multi-level structure, and existing technologies can only perform attack tests on the outermost layer of industrial control networks, making it difficult to fully cover all potential security risks, thereby making the results of attack tests inaccurate and the security protection capabilities of industrial control networks insufficient. Summary of the invention

[0005] The present invention provides an attack test method, device, equipment and storage medium for an industrial control network. By performing attack tests on the industrial control network layer by layer, various potential threats hidden in the industrial control network can be discovered in a timely manner, thereby improving the security protection capability of the industrial control network.

[0006] In a first aspect, an embodiment of the present invention provides an attack testing method for an industrial control network, which is applicable to an industrial control network including at least one layer, and the method includes:

[0007] Obtain the current network nodes at the current level of the industrial control network, as well as the network security vulnerabilities corresponding to each current network node, perform attack tests on each network security vulnerability, and perform security analysis on the industrial control network based on the results of the attack tests;

[0008] Determine at least one network penetration vulnerability that can be used to obtain administrator privileges from among the network security vulnerabilities, and obtain a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability;

[0009] The lower-layer network node is used as the current network node, and the operation of obtaining the network security vulnerabilities corresponding to each current network node is returned until there is no network penetration vulnerability that can be used to obtain the administrator's authority among the network security vulnerabilities.

[0010] Optionally, based on the administrator authority obtained by attacking the network penetration vulnerability, the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained, including: obtaining the number of network cards configured for the target network node to which the network penetration vulnerability belongs, and when the number of network cards is greater than a set network card number threshold, based on the administrator authority obtained by attacking the network penetration vulnerability, obtaining the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs.

[0011] Optionally, when there are multiple network penetration vulnerabilities, based on the administrator authority obtained by attacking the network penetration vulnerability, a lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained, including: obtaining candidate penetration paths corresponding to each network penetration vulnerability, and selecting one from each candidate penetration path as a target penetration path; based on the administrator authority obtained by attacking the network penetration vulnerability in the target penetration path, obtaining a lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs.

[0012] Optionally, one is selected from each candidate penetration path as a target penetration path, including: obtaining vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, and inputting each candidate penetration path and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path into a pre-constructed first Bayesian network model for processing to obtain the target penetration path; wherein the vulnerability assessment results are used to reflect the probability of the network penetration vulnerability being exploited and the potential impact on the industrial control network.

[0013] Optionally, vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path are obtained, including: inputting the attribute information of each network penetration vulnerability as input data into a pre-built second Bayesian network model for processing to obtain the vulnerability assessment results of each network penetration vulnerability; wherein the attribute information of the network penetration vulnerability includes at least one of the following: vulnerability type, vulnerability severity, and importance of network nodes associated with the network penetration vulnerability.

[0014] Optionally, after returning to execute the operation of obtaining the network security vulnerabilities corresponding to each current network node, until there are no network penetration vulnerabilities that can be used to obtain administrator privileges among the network security vulnerabilities, it also includes: generating an overall penetration path corresponding to the industrial control network according to each target penetration path and the network nodes associated with each target penetration path; inputting the overall penetration path, the network security vulnerabilities corresponding to the overall penetration path, and the current state of the industrial control network into a pre-constructed third Bayesian network model for processing to obtain a security protection strategy for the overall penetration path.

[0015] Optionally, after the network security vulnerabilities corresponding to each current network node, it also includes: aggregating the current network nodes under the current level of the industrial control network according to the Internet Protocol addresses corresponding to each current network node, to obtain at least one virtual domain; wherein the number of current network nodes contained in each virtual domain is less than or equal to the set node number threshold.

[0016] In a second aspect, an embodiment of the present invention further provides an attack test device for an industrial control network, which is applicable to an industrial control network including at least one layer, and the device includes:

[0017] The vulnerability detection and analysis module is used to obtain the current network nodes at the current level of the industrial control network, as well as the network security vulnerabilities corresponding to each current network node, perform attack tests on each network security vulnerability, and perform security analysis on the industrial control network based on the results of the attack tests;

[0018] A lower-layer network node acquisition module, used to determine at least one network penetration vulnerability that can be used to obtain administrator privileges among various network security vulnerabilities, and to acquire a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability;

[0019] The cyclic attack test module is used to take the lower-level network node as the current network node and return to execute the operation of obtaining the network security vulnerability corresponding to each current network node until there is no network penetration vulnerability that can be used to obtain administrator privileges in each network security vulnerability.

[0020] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the attack testing method for the industrial control network provided in any embodiment of the present invention.

[0021] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the attack testing method for the industrial control network provided by any embodiment of the present invention when executed.

[0022] The technical solution provided by the embodiment of the present invention can realize attack testing of the industrial control network layer by layer, timely discover various potential threats hidden in the industrial control network, and improve the security protection capability of the industrial control network by determining at least one network penetration vulnerability that can be used to obtain administrator privileges among various network security vulnerabilities, and obtaining the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 This is a flow chart of an attack testing method for an industrial control network provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a schematic diagram for reflecting a process of acquiring a lower-layer network node according to an embodiment of the present invention;

[0027] Figure 3 is a flow chart of another industrial control network attack testing method provided according to Embodiment 2 of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of an attack test device for an industrial control network provided according to Embodiment 3 of the present invention;

[0029] Figure 5 It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Embodiment 1

[0033] Figure 1 This is a flowchart of an attack test method for an industrial control network provided according to Example 1 of the present invention. This embodiment is applicable to the situation where an attack test is performed on an industrial control network including at least one layer. The method can be executed by an attack test device for the industrial control network. The attack test device for the industrial control network can be implemented in the form of hardware and / or software. The attack test device for the industrial control network can be configured in an electronic device such as a computer.

[0034] like Figure 1 As shown, an attack test method for an industrial control network disclosed in this embodiment is applicable to an industrial control network including at least one layer, and the method includes:

[0035] S110, obtaining network security vulnerabilities corresponding to each current network node, performing an attack test on each network security vulnerability, and performing a security analysis on the industrial control network based on the results of the attack test.

[0036] The current network node is a node at the current level of the industrial control network. The current network node can be a connection point or device in the industrial control network, such as a router, a switch, and an industrial control device.

[0037] In this step, specifically, the Simple Network Management Protocol (SNMP) and the Internet Control Message Protocol (ICMP) can be used to obtain the connection relationship between each current network node, and based on each current network node and the connection relationship between each current network node, the current network tree topology corresponding to the current level of the industrial control network is generated. Then, the current network tree topology can be scanned, and a vulnerability detection subtask can be created for each current network node in the current network tree topology. After that, a pre-written vulnerability detection use case can be used in each vulnerability detection subtask to detect network security vulnerabilities corresponding to each current network node, and the detected network security vulnerabilities can be stored in a pre-built security vulnerability list. Finally, an attack test can be performed on each network security vulnerability, and a security analysis of the industrial control network can be performed based on the results of the attack test, and then the security of the industrial control network can be reinforced according to the security analysis results.

[0038] Optionally, the vulnerability detection subtasks can be executed in parallel through multithreading technology to ensure that the server has sufficient resources (such as CPU and memory, etc.) to accelerate the detection of network security vulnerabilities. Furthermore, the execution progress of the vulnerability detection subtasks can be monitored in real time to ensure that the vulnerability detection subtasks are successfully completed.

[0039] S120. Determine at least one network penetration vulnerability that can be used to obtain administrator privileges among the network security vulnerabilities, and obtain a lower-level network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability.

[0040] In this embodiment, the lower-layer network node may be a node belonging to a next level of the industrial control network, and the next level may be a level adjacent to the current level.

[0041] In this step, specifically, a brute force attack can be first performed on the industrial control network based on a known list of administrator accounts and passwords, and after the brute force attack fails, it can be determined whether there is a network penetration vulnerability in each network security vulnerability that can be used to obtain administrator privileges. If so, the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained based on the administrator privileges obtained by attacking the network penetration vulnerability. If not, the results of the attack test for each detected network security vulnerability are output, as well as the security protection strategy obtained by performing a security analysis on the industrial control network based on each attack test result.

[0042] Optionally, based on the administrator authority obtained by attacking the network penetration vulnerability, the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained, including: obtaining the number of network cards configured for the target network node to which the network penetration vulnerability belongs, and when the number of network cards is greater than a set network card number threshold, based on the administrator authority obtained by attacking the network penetration vulnerability, obtaining the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs.

[0043] In a specific implementation, for a Linux system, the number of network cards configured on the target network node can be obtained through the / etc / network / interfaces path. For a Windows system, the network interface information can be queried through a command line tool, and then the number of network cards configured on the target network node can be obtained based on the network interface information. Then, when the number of network cards configured on the target network node is greater than a set network card number threshold, the lower-level network node corresponding to the target network node can be obtained. The network card number threshold can be any value greater than or equal to 1.

[0044] Exemplarily, assuming that the network card number threshold is 1, when the number of network cards configured for the target network node to which the network penetration vulnerability belongs is greater than 1, the administrator privileges can be obtained by attacking the network penetration vulnerability to obtain the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs.

[0045] The advantage of this setting is that since a multi-network card configuration usually means that the network element may be connected to different network segments, when there are multiple target network nodes, it is possible to further determine whether the target network node is configured with multiple network cards. The optimal path for penetrating from the current level of the industrial control network to the next level can be selected, thereby improving the acquisition efficiency of the lower-level network nodes.

[0046] S130 , taking the lower-layer network node as the current network node, and returning to execute S110 .

[0047] In this step, specifically, after taking the lower-layer network node as the current network node, a remote control agent can be created on the lower-layer network element node, and under the control of the remote control agent, the operation of obtaining network security vulnerabilities corresponding to each current network node is returned until there are no network penetration vulnerabilities that can be used to obtain administrator privileges in each network security vulnerability. Among them, the remote control agent can allow the tester to execute commands or run scripts from a remote location to facilitate further scanning and attack testing of the lower-layer network nodes. The creation process of the remote control agent includes: deploying a lightweight daemon process on the target system, and configuring the daemon process to enable it to receive connection requests from a specific IP address or range.

[0048] Optionally, after the network security vulnerabilities corresponding to each current network node, the method further includes: aggregating each current network node at the current level of the industrial control network according to the Internet Protocol address corresponding to each current network node to obtain at least one virtual domain; wherein the number of current network nodes included in each virtual domain is less than or equal to a set node number threshold. The node number threshold can be determined according to user needs and the number of current network nodes.

[0049] In a specific implementation, after obtaining the Internet Protocol addresses (i.e., IP addresses) corresponding to the current network nodes, the current network nodes with different Internet Protocol addresses can be aggregated using the rules of the Class C subnet to obtain at least one virtual domain. Preferably, the number of current network nodes included in each virtual domain can be set to be less than or equal to 254.

[0050] The advantage of such a setting is that, since the number of network nodes contained in the industrial control network is large (such as 1,000), the dragging and zooming operations on the attack test interface of the industrial control network will become abnormally slow, resulting in low efficiency of the attack test of the industrial control network. Therefore, the technical solution of this embodiment proposes a method for aggregating the current network nodes at the current level of the industrial control network, reducing the number of network nodes displayed on the attack test interface of the industrial control network, ensuring the smoothness of the dragging and zooming operations on the attack test interface of the industrial control network, and improving the efficiency of the attack test on the industrial control network.

[0051] The technical solution of this embodiment obtains the current network nodes under the current level of the industrial control network and the network security vulnerabilities corresponding to each current network node, performs attack tests on each network security vulnerability, and performs security analysis on the industrial control network based on the results of the attack tests; determines at least one network penetration vulnerability that can be used to obtain administrator privileges in each network security vulnerability, and obtains the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs according to the administrator privileges obtained by attacking the network penetration vulnerability; uses the lower-level network node as the current network node, and returns to execute the operation of obtaining the network security vulnerabilities corresponding to each current network node, until there are no network penetration vulnerabilities that can be used to obtain administrator privileges in each network security vulnerability. This solves the problem that the prior art can only perform attack tests on the outermost layer of the industrial control network, resulting in insufficient depth and breadth of the attack tests, making it difficult to formulate effective security protection strategies. By performing attack tests on the industrial control network layer by layer, various potential threats hidden in the industrial control network can be discovered in a timely manner, thereby improving the security protection capabilities of the industrial control network.

[0052] To explain the attack test method and effect of the industrial control network in the present invention in detail, an attack test system for an industrial control network that can implement the above technical solution is used as an example for explanation: The front-end page of the attack test system for the industrial control network is mainly as follows: Figure 2 Specifically, the home page of the attack test system for the industrial control network displays the domain aggregation view by default, which includes the attack device, the first switch and the first virtual domain. Double-clicking the virtual domain can jump to the topology subview under the virtual domain. Optionally, a red drill-down arrow can be set above the first virtual domain to indicate that the first virtual domain can further perform penetration testing on the lower-layer network.

[0053] The topology sub-view displays the current network nodes in the first virtual domain and the network security vulnerabilities corresponding to the current network nodes in a hierarchical manner. Specifically, the upper layer in the topology sub-view displays three network nodes aggregated in the first virtual domain: IP1, IP2, and IP3, and the lower layer displays the network security vulnerabilities corresponding to IP1, IP2, and IP3, respectively. Among them, IP3 is configured with dual network cards, and the number of network security vulnerabilities corresponding to IP3 is 6.

[0054] For IP1 and IP2, by performing a brute force attack on the industrial control network according to the known administrator account and password list, the number of lower-level network nodes corresponding to IP1 is 0, and the number of lower-level network nodes corresponding to IP2 is multiple. For IP3, since there is a network penetration vulnerability that can be used to obtain administrator privileges in the network security vulnerability corresponding to IP3, and IP3 is configured with dual network cards, the lower-level network nodes corresponding to IP3 can be obtained according to the administrator privileges obtained by attacking the network penetration vulnerability. Then, the second virtual domain can be generated according to the lower-level network node corresponding to IP2, and the third virtual domain can be generated according to the lower-level network node corresponding to IP3, and the second virtual domain and the third virtual domain can be integrated into the network structure displayed in the domain aggregation view to obtain an updated domain aggregation view. Optionally, the color of the drill-down arrow above the first virtual domain can be changed to green to indicate that the lower-level network node is successfully obtained. Finally, the attack device can be used to attack IP4 in the third virtual domain. In order to improve the clarity of the view and user experience, only the attack path shown in the penetration attack view is displayed in the front-end page. Users can obtain attack benefits by clicking on the attacked node on the attack path. It is worth noting that in order to optimize the three-dimensional topology layout and reduce lag, the attack test system of this industrial control network flattens the various levels in the industrial control network.

[0055] The above technical solution aggregates network nodes in a three-dimensional view and simplifies each virtual domain into a point mark, so that network nodes in the same virtual domain can be automatically shrunk, reducing the complexity of the interface, ensuring smoothness when dragging and scaling the view, and improving the efficiency of attack testing and user experience. Secondly, by setting a drill-down arrow above the virtual domain, the entire penetration test process can be made clearer and easier for testers to track and understand. Thirdly, by double-clicking a point in a virtual domain to view the topology subview under the virtual domain, the perspective transition from macro to micro is realized. Finally, by setting a "return to main view" button on each view, you can return to the domain aggregation view displayed on the previous homepage at any time, which provides convenience for comparing and analyzing network structures at different levels.

[0056] Embodiment 2

[0057] Figure 3 It is a flowchart of another industrial control network attack test method provided according to the second embodiment of the present invention. This embodiment is a further optimization and expansion based on the above embodiments, and can be combined with various optional technical solutions in the above implementation methods.

[0058] like Figure 3 As shown, an attack test method for an industrial control network disclosed in this embodiment is applicable to an industrial control network including at least one layer, and the method includes:

[0059] S210, obtaining network security vulnerabilities corresponding to each current network node, performing an attack test on each network security vulnerability, and performing a security analysis on the industrial control network based on the results of the attack test.

[0060] The current network node is a node at the current level of the industrial control network.

[0061] S220, determining a plurality of network penetration vulnerabilities that can be used to obtain administrator privileges from among the network security vulnerabilities, and selecting one as a target penetration path from among the candidate penetration paths corresponding to the network penetration vulnerabilities.

[0062] In this embodiment, the network penetration vulnerability can be used to obtain administrator privileges for the industrial control network. The candidate penetration path can be a penetration path composed of at least one network penetration vulnerability.

[0063] In this step, specifically, a first Bayesian network model constructed in advance can be used to select one of the candidate penetration paths as a target penetration path.

[0064] Optionally, one is selected from each candidate penetration path as a target penetration path, including: obtaining vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, and inputting each candidate penetration path and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path into a pre-constructed first Bayesian network model for processing to obtain the target penetration path.

[0065] In this embodiment, the vulnerability assessment result is used to reflect the probability of network penetration vulnerability being exploited and the potential impact on the industrial control network. The first Bayesian network model uses the historical candidate penetration paths and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each historical candidate penetration path as training samples to train the preset neural network model.

[0066] Specifically, the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path can be determined according to the type of network penetration vulnerability and the pre-stored network vulnerability assessment table. Among them, the network vulnerability assessment table contains the correspondence between the type of network penetration vulnerability and the vulnerability assessment result. Alternatively, the attribute information of each network penetration vulnerability is used as input data and input into the pre-built second Bayesian network model for processing to obtain the vulnerability assessment results of each network penetration vulnerability. Among them, the attribute information of the network penetration vulnerability may include at least one of the following: vulnerability type, vulnerability severity, and the importance of the network node associated with the network penetration vulnerability. The severity of the vulnerability can be determined by the Common Vulnerability Scoring System (CVSS).

[0067] Taking the target network node as IP3 as an example, assuming that the first vulnerability and the third vulnerability corresponding to IP3 are multiple network penetration vulnerabilities that can be used to obtain administrator privileges, the path from IP3 to the first vulnerability can be used as the first candidate penetration path, and the path from IP3 to the third vulnerability can be used as the second candidate penetration path. Then, the attribute information of the first vulnerability and the attribute information of the second vulnerability can be respectively input into the pre-built second Bayesian network model for processing, and the vulnerability assessment results corresponding to the first vulnerability and the second vulnerability can be obtained. Finally, the first candidate penetration path, the second candidate penetration path, and the vulnerability assessment results corresponding to the first vulnerability and the second vulnerability can be input into the pre-built first Bayesian network model for processing to obtain the target penetration path. Among them, the vulnerability assessment results can be displayed in the topology subview, and the target penetration path can be displayed in the updated domain aggregation view.

[0068] The benefit of this setting is that the optimal penetration path is determined through the vulnerability assessment results, taking into account the probability of network penetration vulnerabilities being exploited and the potential impact on the industrial control network, reducing the possibility of the penetration path being detected and defended by security devices in the industrial control network (such as firewalls and intrusion detection systems, etc.), and improving the success rate of network penetration attacks. Secondly, by identifying and utilizing the optimal penetration path, it is easy to find the weak links in the industrial control network, providing a basis for subsequent security reinforcement of the industrial control network. Finally, by displaying the vulnerability assessment results in the topology subview, it can help users quickly identify high-risk network nodes. By displaying the target penetration path in the updated domain aggregation view, it can help users choose the optimal penetration path.

[0069] S230. According to the administrator authority obtained by attacking the network penetration vulnerability in the penetration path of the target, obtain the lower-layer network node corresponding to the target network node to which the network penetration vulnerability belongs, and use the lower-layer network node as the current network node.

[0070] S240, determining whether there is a network penetration vulnerability that can be used to obtain administrator privileges among the network security vulnerabilities corresponding to the current network node, if so, returning to execute S210, if not, executing S250.

[0071] S250. Generate an overall penetration path corresponding to the industrial control network based on each target penetration path and the network nodes associated with each target penetration path.

[0072] In this step, specifically, an overall penetration path corresponding to the industrial control network can be generated based on each target penetration path, the network nodes associated with each target penetration path, and the connection relationship between each target penetration path and each network node.

[0073] Combination Figure 2 In the penetration attack view in , assuming that the target penetration path is the first candidate penetration path, the first switch and attack device associated with IP3, as well as the second switch and IP4 obtained through the first vulnerability can be obtained. If there is no network security vulnerability on IP4 that can be used to obtain administrator privileges, the overall penetration path corresponding to the industrial control network can be generated based on the attack device, the first switch, IP3, the first vulnerability, the second switch, and IP4. If there is a network security vulnerability on IP4 that can be used to obtain administrator privileges, the overall penetration path can be further generated based on the first candidate penetration path and the target penetration path corresponding to IP4.

[0074] S260, input the overall penetration path, the network security vulnerability corresponding to the overall penetration path, and the current state of the industrial control network into a pre-built third Bayesian network model for processing to obtain a security protection strategy for the overall penetration path.

[0075] In this embodiment, the current state of the industrial control network includes but is not limited to the topology of the industrial control network, the state of the network nodes, and the discovered network security vulnerabilities. The security protection strategy may include patching vulnerabilities and strengthening access control.

[0076] In this step, optionally, after the overall penetration path, the network security vulnerability corresponding to the overall penetration path, and the current state of the industrial control network are input into the pre-built third Bayesian network model for processing, a security protection strategy for the overall penetration path, as well as the expected cost and expected effect of implementing the security protection strategy can be obtained. Among them, the expected effect can be used to reflect the extent to which the security protection strategy can reduce the risk of industrial control network intrusion.

[0077] The technical solution of this embodiment determines the optimal penetration path (that is, the target penetration path) through the vulnerability assessment results, takes into account the probability of network penetration vulnerabilities being exploited and the potential impact on the industrial control network, reduces the possibility of the penetration path being detected and defended by security devices in the industrial control network (such as firewalls and intrusion detection systems, etc.), improves the success rate of network penetration attacks, and provides a basis for selecting the optimal security protection strategy. Secondly, since the target penetration path is the optimal penetration attack path, the overall penetration path is generated through each target penetration path, and a security protection strategy related to the overall penetration path is formulated, which provides a basis for effectively responding to network security threats.

[0078] Based on the above embodiments, the present invention provides a preferred implementation method: Step 1, use the SNMP protocol and the ICMP protocol to scan a layer of network (that is, the outermost layer of the industrial control network) to obtain the association relationship between each current network node, and generate the current network tree topology structure according to each current network node and the association relationship between each current network node. Step 2, establish a vulnerability detection subtask for each current network node in the current network tree topology structure, and perform vulnerability detection in the vulnerability detection subtask according to the pre-written industrial control vulnerability detection use case to obtain the network security vulnerabilities corresponding to each current network node. Optionally, the vulnerability detection subtask can be mounted in the form of a slave table under the main task of attacking the industrial control network, avoiding complex master-slave-slave data structure or even master-slave-slave-slave data structure, ensuring that all vulnerability detection subtasks can run efficiently. When there are multiple vulnerability detection subtasks, multi-threading can be used to concurrently process each vulnerability detection subtask to increase the speed of vulnerability detection. Step 3: The rules of the Class C subnet can be used to aggregate the current network nodes under the current level of the industrial control network to obtain at least one virtual domain to avoid the problem of reduced processing performance due to too many network nodes. Among them, the number of current network nodes contained in each virtual domain is less than or equal to 254. Step 4: When there are multiple network penetration vulnerabilities that can be used to obtain administrator privileges in each network security vulnerability, determine the candidate penetration path corresponding to each network penetration vulnerability. Step 5: Obtain the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, and input each candidate penetration path and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path into the pre-constructed first Bayesian network model for processing to obtain the target penetration path. Step 6: According to the administrator privilege obtained by attacking the network penetration vulnerability in the target penetration path, obtain the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs. Step 7: After taking the lower-level network node as the current network node, return to execute step 1 until there are no network penetration vulnerabilities that can be used to obtain administrator privileges in each network security vulnerability. Step 8. Based on each target penetration path and the network nodes associated with each target penetration path, an overall penetration path corresponding to the industrial control network is generated, and the overall penetration path, the network security vulnerabilities corresponding to the overall penetration path, and the current state of the industrial control network are input into the pre-built third Bayesian network model for processing to obtain a security protection strategy for the overall penetration path.

[0079] It is worth noting that every time step 2 is executed, an attack test must be performed on the newly discovered network security vulnerabilities to achieve a comprehensive attack test on the industrial control network, providing a basis for security reinforcement of the industrial control network.

[0080] Embodiment 3

[0081] Figure 4 This is a structural diagram of an attack test device for an industrial control network provided according to Example 3 of the present invention. This embodiment can be applied to situations where an attack test is performed on an industrial control network containing at least one layer. The attack test device for the industrial control network can be implemented in the form of hardware and / or software and can be configured in an electronic device such as a computer.

[0082] like Figure 4 As shown, the attack test device for the industrial control network disclosed in this embodiment includes: a vulnerability detection and analysis module 41, a lower-layer network node acquisition module 42 and a cyclic attack test module 43, wherein:

[0083] The vulnerability detection and analysis module 41 is used to obtain the current network nodes at the current level of the industrial control network and the network security vulnerabilities corresponding to each current network node, perform an attack test on each network security vulnerability, and perform a security analysis on the industrial control network based on the results of the attack test;

[0084] A lower-layer network node acquisition module 42 is used to determine at least one network penetration vulnerability that can be used to obtain administrator privileges from among various network security vulnerabilities, and to acquire a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability;

[0085] The cyclic attack test module 43 is used to take the lower network node as the current network node and return to execute the operation of obtaining the network security vulnerability corresponding to each current network node until there is no network penetration vulnerability that can be used to obtain administrator privileges in the network security vulnerabilities.

[0086] The technical solution in this embodiment, through the mutual cooperation of the vulnerability detection and analysis module, the lower-layer network node acquisition module and the cyclic attack test module, solves the problem that the prior art can only perform attack tests on the outermost layer of the industrial control network, resulting in insufficient depth and breadth of the attack tests, making it difficult to formulate effective security protection strategies. By performing attack tests on the industrial control network layer by layer, various potential threats hidden in the industrial control network can be discovered in a timely manner, thereby improving the security protection capabilities of the industrial control network.

[0087] Optionally, the lower-level network node acquisition module 42 is specifically used to: obtain the number of network cards configured for the target network node to which the network penetration vulnerability belongs, and when the number of network cards is greater than a set threshold value of the number of network cards, obtain administrator privileges based on attacking the network penetration vulnerability, and obtain the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs.

[0088] Optionally, the lower-level network node acquisition module 42 is specifically used to: obtain candidate penetration paths corresponding to each network penetration vulnerability, and select one from each candidate penetration path as a target penetration path; obtain the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs based on the administrator authority obtained by attacking the network penetration vulnerability in the target penetration path.

[0089] Optionally, one is selected from each candidate penetration path as a target penetration path, including: obtaining vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, and inputting each candidate penetration path and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path into a pre-constructed first Bayesian network model for processing to obtain the target penetration path; wherein the vulnerability assessment results are used to reflect the probability of the network penetration vulnerability being exploited and the potential impact on the industrial control network.

[0090] Optionally, vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path are obtained, including: inputting the attribute information of each network penetration vulnerability as input data into a pre-built second Bayesian network model for processing to obtain the vulnerability assessment results of each network penetration vulnerability; wherein the attribute information of the network penetration vulnerability includes at least one of the following: vulnerability type, vulnerability severity, and importance of network nodes associated with the network penetration vulnerability.

[0091] Optionally, the device also includes a security protection strategy determination model, which is used to: generate an overall penetration path corresponding to the industrial control network based on each target penetration path and the network nodes associated with each target penetration path; input the overall penetration path, the network security vulnerabilities corresponding to the overall penetration path, and the current state of the industrial control network into a pre-constructed third Bayesian network model for processing to obtain a security protection strategy for the overall penetration path.

[0092] Optionally, the device also includes a domain aggregation model, which is used to: aggregate each current network node under the current level of the industrial control network according to the Internet Protocol address corresponding to each current network node, to obtain at least one virtual domain; wherein the number of current network nodes contained in each virtual domain is less than or equal to a set node number threshold.

[0093] The attack test device for industrial control network provided in the embodiment of the present invention can execute the attack test method for industrial control network provided in any embodiment 1 of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. The contents not described in detail in this embodiment can refer to the description in any method embodiment of this application.

[0094] Embodiment 4

[0095] Figure 5 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown.

[0096] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0097] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0098] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the attack test method of the industrial control network.

[0099] In some embodiments, the attack test method for the industrial control network can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the attack test method for the industrial control network described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the attack test method for the industrial control network in any other appropriate manner (for example, by means of firmware).

[0100] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0101] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0102] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0103] To provide interaction with a client user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client user can provide input to the electronic device. Other types of devices may also be used to provide interaction with a client user; for example, the feedback provided to the client user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the client user may be received in any form (including acoustic input, voice input, or tactile input).

[0104] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a client user computer with a graphical client user interface or a web browser through which a client user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0105] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0106] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0107] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An attack test method for an industrial control network, characterized in that: Applicable to an industrial control network including at least one level, the method comprises: Obtaining current network nodes at the current level of the industrial control network and network security vulnerabilities corresponding to each current network node, performing an attack test on each network security vulnerability, and performing a security analysis on the industrial control network based on the results of the attack test; Determine at least one network penetration vulnerability that can be used to obtain administrator privileges from among the network security vulnerabilities, and obtain a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability; The lower-layer network node is used as the current network node, and the operation of obtaining network security vulnerabilities corresponding to each current network node is returned to be executed until there is no network penetration vulnerability that can be used to obtain administrator privileges among the network security vulnerabilities.

2. The method according to claim 1, characterized in that According to the administrator privileges obtained by attacking the network penetration vulnerability, the lower-level network nodes corresponding to the target network node to which the network penetration vulnerability belongs are obtained, including: The number of network cards configured for the target network node to which the network penetration vulnerability belongs is obtained, and when the number of network cards is greater than the set network card number threshold, the administrator authority is obtained according to the attack on the network penetration vulnerability, and the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained.

3. The method according to claim 1, characterized in that: When there are multiple network penetration vulnerabilities, the lower-level network nodes corresponding to the target network nodes to which the network penetration vulnerabilities belong are obtained according to the administrator privileges obtained by attacking the network penetration vulnerabilities, including: Obtain candidate penetration paths corresponding to each of the network penetration vulnerabilities, and select one of the candidate penetration paths as a target penetration path; According to the administrator authority obtained from the network penetration vulnerability in the penetration path of the attack target, the lower-level network node corresponding to the target network node to which the network penetration vulnerability belongs is obtained.

4. The method according to claim 3, characterized in that Selecting one of the candidate penetration paths as a target penetration path includes: Obtain vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, and input each of the candidate penetration paths and the vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path into a pre-constructed first Bayesian network model for processing to obtain a target penetration path; Among them, the vulnerability assessment results are used to reflect the probability of network penetration vulnerabilities being exploited and the potential impact on industrial control networks.

5. The method according to claim 4, characterized in that Obtain vulnerability assessment results corresponding to the network penetration vulnerabilities in each candidate penetration path, including: The attribute information of each network penetration vulnerability is used as input data and input into the pre-built second Bayesian network model for processing to obtain the vulnerability assessment results of each network penetration vulnerability; The attribute information of the network penetration vulnerability includes at least one of the following: vulnerability type, vulnerability severity, and importance of the network node associated with the network penetration vulnerability.

6. The method according to claim 3, characterized in that After returning to execute the operation of obtaining the network security vulnerabilities corresponding to each current network node respectively until there is no network penetration vulnerability that can be used to obtain the administrator's rights among the network security vulnerabilities, it also includes: Generate an overall penetration path corresponding to the industrial control network according to each of the target penetration paths and the network nodes associated with each of the target penetration paths; The overall penetration path, the network security vulnerability corresponding to the overall penetration path, and the current state of the industrial control network are input into a pre-built third Bayesian network model for processing to obtain a security protection strategy for the overall penetration path.

7. The method according to any one of claims 1 to 6, characterized in that: After the network security vulnerabilities corresponding to each current network node, it also includes: Aggregating each current network node at a current level of the industrial control network according to the Internet Protocol addresses corresponding to each current network node to obtain at least one virtual domain; The number of current network nodes included in each virtual domain is less than or equal to a set node number threshold.

8. An attack test device for an industrial control network, characterized in that: Applicable to an industrial control network including at least one level, the device comprises: A vulnerability detection and analysis module is used to obtain the current network nodes at the current level of the industrial control network, and the network security vulnerabilities corresponding to each current network node, perform an attack test on each network security vulnerability, and perform a security analysis on the industrial control network based on the results of the attack test; A lower-layer network node acquisition module, used to determine at least one network penetration vulnerability that can be used to obtain administrator privileges from among the network security vulnerabilities, and to acquire a lower-layer network node corresponding to a target network node to which the network penetration vulnerability belongs based on the administrator privileges obtained by attacking the network penetration vulnerability; The cyclic attack test module is used to take the lower-level network node as the current network node and return to execute the operation of obtaining the network security vulnerability corresponding to each current network node until there is no network penetration vulnerability that can be used to obtain administrator privileges in the network security vulnerabilities.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the attack testing method for the industrial control network described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the attack testing method for an industrial control network according to any one of claims 1 to 7 when executed.

Images