Industrial control network security protection simulation system

Abstract

The invention provides an industrial control network security protection simulation system, which comprises an industrial control virtual platform, a simulation control platform and a monitoring and analysis platform, the industrial control virtual platform is used for simulating an industrial control network equipment environment and an industrial control system environment; the simulation control platform is used for attacking the industrial control virtual platform on the basis of the industrial control virtual platform; and the monitoring and analysis platform is used for monitoring the condition that the simulation control platform attacks the industrial control virtual platform in real time, analyzing existing vulnerabilities in time and being capable of self-repairing. According to the industrial control network security protection simulation system provided by the invention, protection simulation is carried out in a perfection process by continuously self-repairing vulnerabilities occurring in an industrial control virtual system, so that a real person confrontation effect is achieved, and a better protection simulation effect can be achieved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to an industrial control network security protection simulation system. Background Art

[0002] Network security usually refers to the security of computer networks, but in fact it can also refer to the security of computer communication networks; a computer communication network is a system that interconnects several computers with independent functions through communication equipment and transmission media, and realizes information transmission and exchange between computers with the support of communication software. A computer network is a system that uses communication means to connect several relatively dispersed independent computer systems, terminal devices and data devices for the purpose of sharing resources, and exchanges data under the control of protocols.

[0003] In the existing Chinese patent, the publication number is: CN 112615836 A, an industrial control network security protection simulation system, including a penetration attack platform, a detection and protection platform and an industrial control system; the industrial control system includes physical nodes and virtual nodes; the penetration attack platform is used to attack the target node in the industrial control system and obtain attack information; wherein the target node is the physical node or the virtual node; the detection and protection platform is used to retrieve the target protection rules according to the attack information for attack protection; the industrial control network security protection simulation system can not only effectively ensure the accuracy of the industrial control network security research results, but also has low cost and high scalability. From the above patent, it can be seen that the importance of the industrial control network security protection simulation system, but the above patent is only a single test without changing the system, lacking actual people to confront, and only protecting the original function of the system, so that the data is only the data of a single system protection, lacking human participation, resulting in incomplete data and lack of more fitting data. Summary of the invention

[0004] In view of this, the present invention aims to propose an industrial control network security protection simulation system to solve the problems raised in the above background technology.

[0005] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0006] An industrial control network security protection simulation system includes an industrial control virtual platform, a simulation control platform, and a monitoring and analysis platform;

[0007] Industrial control virtual platform, used to simulate industrial control network equipment environment and industrial control system environment;

[0008] Simulation control platform, used to attack the industrial control virtual platform based on the industrial control virtual platform;

[0009] The monitoring and analysis platform is used to monitor in real time the simulation control platform's attacks on the industrial control virtual platform, analyze existing vulnerabilities in a timely manner, and can self-repair.

[0010] Furthermore, the industrial control virtual platform includes a virtual host, a virtual router, a virtual firewall and a virtual industrial control network equipment environment;

[0011] Virtual host, used to replace the host to store and control industrial control systems;

[0012] Virtual router, used to replace the router to achieve network communication with various virtual devices and systems;

[0013] Virtual firewall, used to replace the firewall to protect the normal operation of the industrial control virtual platform;

[0014] A virtual industrial control network equipment environment is used to replace individual devices.

[0015] Furthermore, the virtual industrial control network equipment environment includes a temperature measurement module and a pause module.

[0016] Temperature measurement module, used to simulate the temperature changes in the virtual industrial control network equipment environment;

[0017] The pause module is used to simulate the result of pausing the virtual industrial control network equipment environment.

[0018] Furthermore, the simulation control platform includes a crawler tool, a parsing tool and an attack tool.

[0019] Crawler tool, used to obtain relevant data of the industrial control virtual platform and pass it to the parsing tool;

[0020] Parsing tools, which analyze the data obtained by crawler tools and identify corresponding vulnerabilities;

[0021] Attack tools selectively attack industrial control virtual platforms based on the vulnerabilities found by the parsing tools.

[0022] Furthermore, the simulation control platform also includes a lifting tool,

[0023] Improve tools to learn vulnerabilities and develop new attack tools.

[0024] Among them, the improvement tool has built-in AI algorithm and self-learning algorithm.

[0025] Furthermore, the simulation control platform also includes a protection rule base, which is used to store Snort-based protection rules.

[0026] Furthermore, the monitoring and analysis platform includes monitoring tools, analysis tools and interaction tools;

[0027] Monitoring tools, used to monitor the attack of the simulation control platform on the industrial control virtual platform;

[0028] Analysis tools analyze the data monitored by the monitoring tools to find loopholes and pass them to the interactive tools;

[0029] Interactive tools to communicate analyzed vulnerabilities to the outside world.

[0030] Furthermore, the monitoring and analysis platform also includes a self-repair tool, which is used to repair the analyzed vulnerabilities.

[0031] Furthermore, the analysis tool has a built-in crawler algorithm.

[0032] Compared with the prior art, the industrial control network security protection simulation system described in the present invention has the following advantages:

[0033] (1) The industrial control network security protection simulation system described in the present invention can achieve a better protection simulation effect by continuously self-repairing the vulnerabilities in the industrial control virtual system and performing protection simulation during the improvement process to achieve the effect of real-person confrontation. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0035] Figure 1 It is a principle block diagram of the industrial control network security protection simulation system according to an embodiment of the present invention;

[0036] Figure 2 It is a principle block diagram of the industrial control virtual platform in the industrial control network security protection simulation system according to an embodiment of the present invention;

[0037] Figure 3 It is a principle block diagram of a simulation control platform in the industrial control network security protection simulation system according to an embodiment of the present invention;

[0038] Figure 4 This is a principle block diagram of the monitoring and analysis platform in the industrial control network security protection simulation system described in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0040] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", and the like may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0041] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0042] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0043] An industrial control network security protection simulation system, such as Figures 1 to 4 As shown, it includes industrial control virtual platform, simulation control platform and monitoring and analysis platform;

[0044] Industrial control virtual platform, used to simulate industrial control network equipment environment and industrial control system environment;

[0045] Simulation control platform, used to attack the industrial control virtual platform based on the industrial control virtual platform;

[0046] The monitoring and analysis platform is used to monitor in real time the simulation control platform's attacks on the industrial control virtual platform, analyze existing vulnerabilities in a timely manner, and has self-repair capabilities.

[0047] When in use, first start the industrial control virtual platform. When it is checked that the industrial control network equipment environment simulated by the industrial control virtual platform is the same as the actual network equipment environment, and the industrial control system environment is consistent with the actual industrial control system environment (or meets the simulation requirements), start the monitoring and analysis platform and the simulation control platform at the same time to perform protection simulation. The simulation control platform attacks the industrial control virtual platform and monitors it in real time through the monitoring and analysis platform. The monitoring and analysis platform analyzes the attack vulnerabilities during the monitoring process, continuously self-repairs the vulnerabilities that appear in the industrial control virtual platform, and performs protection simulation during the improvement process to achieve better protection simulation effects.

[0048] The industrial control virtual platform includes a virtual host, a virtual router, a virtual firewall and a virtual industrial control network equipment environment;

[0049] The virtual host is used to replace the host actually used in the industrial control system to store and control the industrial control system;

[0050] The virtual router is used to replace the router actually used in the industrial control system to achieve network communication with various virtual devices and systems;

[0051] The virtual firewall is used to replace the actual firewall used in the industrial control system to protect the normal operation of the industrial control virtual platform;

[0052] The virtual industrial control network equipment environment is used to replace the operation of each device when the industrial control system is actually used.

[0053] When in use, the system is called and controlled through the virtual host, and then the various virtual devices and systems are communicated through the virtual router network. The virtual firewall can simulate the actual firewall function and play a protective role when the simulated control platform is attacked. Sometimes the vulnerability of the attack will cause a program to be disordered or deleted, causing the equipment in the virtual industrial control network equipment environment to become abnormal. Over time, it is easy to cause direct damage to the equipment, so it is possible to detect problems that may occur when the equipment is faced.

[0054] Wherein, the virtual industrial control network equipment environment has a built-in temperature measurement module and a pause module;

[0055] The temperature measurement module is used to simulate the temperature change in the virtual industrial control network equipment environment;

[0056] The pause module is used to simulate the result of pausing the virtual industrial control network equipment environment.

[0057] During use, when an abnormality occurs in a device in the virtual industrial control network device environment, the temperature of the device is measured by the temperature measurement module, and timely protection is carried out through the pause module. Through protection simulation, further detection can be carried out to see whether timely suspension will be hindered, making the anti-slip simulation detection more comprehensive.

[0058] Wherein, the simulation control platform includes crawler tools, parsing tools and attack tools;

[0059] The crawler tool is used to obtain relevant data of the industrial control virtual platform and pass it to the parsing tool;

[0060] The analysis tool analyzes the data obtained by the crawler tool to analyze the corresponding vulnerabilities;

[0061] The attack tool selectively attacks the industrial control virtual platform according to the vulnerabilities obtained by the parsing tool.

[0062] When in use, the simulation control platform can attack the industrial control virtual platform through attack tools, and continuously obtain relevant data of the industrial control virtual platform through crawler tools. The crawler tools can also obtain methods of cracking related vulnerabilities from the outside world, and then parse the corresponding methods through parsing tools to attack the industrial control virtual platform. It is currently in continuous improvement, and detects the protection simulation problems of the existing industrial control virtual platform under the condition of joint network data, so as to better improve the industrial control virtual platform and enable the industrial control virtual platform to be continuously improved and perfected in the future.

[0063] Wherein, the simulation control platform also includes a lifting tool;

[0064] The enhancement tool is used to learn about vulnerabilities and form new attack tools to facilitate the use of the attack tools.

[0065] When in use, the simulation control platform can learn from the existing vulnerabilities in conjunction with the network to form new attack tools. During the attack, it can continuously improve the interaction between the attacker and the attacked, which is conducive to promoting the improvement of the industrial control virtual platform.

[0066] Among them, the improvement tool has built-in AI algorithm and self-learning algorithm, and both AI algorithm and self-learning algorithm are existing algorithms and will not be described in detail here.

[0067] When in use, the self-learning and improvement of vulnerabilities through the intelligent algorithm and self-learning algorithm of the AI ​​algorithm is helpful to enhance the tool's ability to enhance the simulation control platform's attack on the industrial control virtual platform, and is more conducive to detecting situations in which the existing industrial control virtual platform responds.

[0068] Wherein, the simulation control platform also includes a protection rule library;

[0069] The protection rule library is used to store various protection rules, and each protection rule can be a Snort-based protection rule.

[0070] Wherein, the monitoring and analysis platform includes monitoring tools, analysis tools and interactive tools;

[0071] The monitoring tool is used to monitor the attack of the simulation control platform on the industrial control virtual platform;

[0072] The analysis tool analyzes the monitored situation and finds out the existing vulnerabilities and sends them to the interactive tool;

[0073] The interactive tool transmits the results obtained by the analysis tool to the outside world.

[0074] When in use, the monitoring tool is used to monitor the attack situation, and then the attack situation is passed to the interactive tool through the analysis tool, and then passed to the engineer (this system uses artificial intelligence instead) through the interactive tool for modification.

[0075] Wherein, the monitoring and analysis platform also includes a self-healing tool;

[0076] The self-repair tool is used to repair the vulnerabilities found in the analysis.

[0077] When in use, the self-repair tools can be used to repair the vulnerabilities that appear in order to deal with attacks.

[0078] The analysis tool has a built-in crawler algorithm, and the use of the crawler algorithm facilitates the analysis tool to obtain more information.

[0079] This solution continuously self-repairs the vulnerabilities in the industrial control virtual system and performs protection simulation during the improvement process to achieve the effect of real-life confrontation, which can better produce the protection simulation effect.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An industrial control network security protection simulation system, characterized by: Including industrial control virtual platform, simulation control platform and monitoring and analysis platform, Industrial control virtual platform, used to simulate industrial control network equipment environment and industrial control system environment; Simulation control platform, used to attack the industrial control virtual platform based on the industrial control virtual platform; The monitoring and analysis platform is used to monitor in real time the simulation control platform's attacks on the industrial control virtual platform, analyze existing vulnerabilities in a timely manner, and can self-repair.

2. The industrial control network security protection simulation system according to claim 1 is characterized by: The industrial control virtual platform includes a virtual host, a virtual router, a virtual firewall and a virtual industrial control network equipment environment; Virtual host, used to replace the host to store and control industrial control systems; Virtual router, used to replace the router to achieve network communication with various virtual devices and systems; Virtual firewall, used to replace the firewall to protect the normal operation of the industrial control virtual platform; A virtual industrial control network equipment environment is used to replace individual devices.

3. The industrial control network security protection simulation system according to claim 2 is characterized in that: The virtual industrial control network equipment environment includes a temperature measurement module and a pause module. Temperature measurement module, used to simulate the temperature changes in the virtual industrial control network equipment environment; The pause module is used to simulate the result of pausing the virtual industrial control network equipment environment.

4. The industrial control network security protection simulation system according to claim 1 is characterized in that: The simulation control platform includes crawler tools, parsing tools and attack tools. Crawler tool, used to obtain relevant data of the industrial control virtual platform and pass it to the parsing tool; Parsing tools, which analyze the data obtained by crawler tools and identify corresponding vulnerabilities; Attack tools selectively attack industrial control virtual platforms based on the vulnerabilities found by the parsing tools.

5. The industrial control network security protection simulation system according to claim 1 is characterized in that: in, The simulation control platform also includes a lifting tool, Improve tools to learn vulnerabilities and develop new attack tools; Among them, the improvement tool has built-in AI algorithm and self-learning algorithm.

6. The industrial control network security protection simulation system according to claim 1 is characterized in that: The simulation control platform also includes a protection rule base, which is used to store Snort-based protection rules.

7. The industrial control network security protection simulation system according to claim 1 is characterized by: The monitoring and analysis platform includes monitoring tools, analysis tools and interactive tools; Monitoring tools, used to monitor the attack of the simulation control platform on the industrial control virtual platform; Analysis tools analyze the data monitored by the monitoring tools to find loopholes and pass them to the interactive tools; Interactive tools to communicate analyzed vulnerabilities to the outside world.

8. The industrial control network security protection simulation system according to claim 1 is characterized by: The monitoring and analysis platform also includes a self-repair tool, which is used to repair the analyzed vulnerabilities.

9. The industrial control network security protection simulation system according to claim 7, characterized in that: The analysis tool has a built-in crawler algorithm.

Images