Industrial control honey pot concealment detection method and system

Abstract

The invention discloses an industrial control honey pot concealment detection method and system, and belongs to the technical field of industrial control safety. According to the method, by comprehensively considering the information, the IP address, the communication data packet, the operating system fingerprint, the open service and other dimensions of the to-be-detected object, whether the to-be-detected object is the industrial honeypot or not can be judged more comprehensively and meticulously. Through the method, the weak part of the industrial control honey pot can be found out, the hiding performance of the industrial control honey pot is further improved on the basis, and compared with a single-dimension detection means, the probability of false alarm and missing alarm can be greatly reduced, and the accuracy and reliability of detection are improved. According to the method, various characteristics of the to-be-detected object are deeply analyzed, so that the concealment of the industrial control honey pot is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control security, and in particular relates to a method and system for detecting the concealment of an industrial control honeypot. Background Art

[0002] As industrial control systems are increasingly connected to the Internet, attacks occur frequently, posing a serious threat to production safety and social stability. Traditional security protection measures are often difficult to cope with complex attacks against industrial control systems. Therefore, the research and application of industrial control honeypots have gradually received attention and become an effective active defense tool to help companies strengthen security monitoring and response capabilities for industrial control environments. Through honeypot technology, it is not only possible to identify and analyze the behavior of attackers, but also to promptly discover and repair security risks in the system, thereby improving overall security. In recent years, there have been representative industrial control honeypot applications, but due to the complexity and closed nature of industrial control systems, industrial control honeypots have many limitations in their own functions, scene construction, and other aspects, so they are easily identified by attackers, and there is a risk of being exploited by the attacked party. Summary of the invention

[0003] The purpose of the present invention is to overcome the above-mentioned shortcomings of the prior art and provide a method and system for detecting the concealment of an industrial control honeypot, so as to solve the problem in the prior art that the industrial control honeypot is easily identified by the attacker and then exploited.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions: A method for detecting the concealment of an industrial control honeypot comprises the following steps: Determine whether the object to be detected is an industrial honeypot based on the information of the object to be detected; the information includes information displayed by the object to be detected and key information; Determine whether the object to be detected is an industrial honeypot based on the IP address of the object to be detected; Establishing a communication connection with the object to be detected, and determining whether the object to be detected is an industrial honeypot based on the data packet; Based on the fingerprint of the operating system of the object to be detected, determining whether the object to be detected is an industrial honeypot; Scan and identify the open services of the object to be detected, and determine whether the object to be detected is an industrial honeypot.

[0005] A further improvement of the present invention is: Preferably, the process of judging whether the object to be detected is an industrial honeypot based on the information displayed by the object to be detected is: judging the information displayed by the object to be detected, and if the displayed information is more than the networked industrial control equipment, judging that the object to be detected is an industrial control honeypot.

[0006] Preferably, the process of judging whether the object to be detected is an industrial honeypot based on key information is: searching through a cyberspace search engine, and if security information related to the object to be detected is detected, judging that the object to be detected is an industrial control honeypot.

[0007] Preferably, the process of judging whether the object to be detected is an industrial honeypot based on the IP of the object to be detected is: if the service provider operator corresponds to the IP address of the object to be detected, and the operator is a cloud service operator, and the industrial control protocol service is open, then the object to be detected is an industrial control honeypot.

[0008] Preferably, the process of judging whether the object to be detected is an industrial honeypot based on the IP of the object to be detected is: if the service provider corresponding to the IP of the object to be detected provides operator and organization information, judging whether the object to be detected is an industrial honeypot based on the organization information.

[0009] Preferably, the process of determining whether the object to be detected is an industrial honeypot based on the data packet is: establishing a communication connection with the object to be detected, detecting whether the keywords in the data link layer field in the data packet contain keywords related to the device, and if they contain keywords related to the device, the object to be detected is an industrial control device.

[0010] Preferably, the process of determining whether the object to be detected is an industrial honeypot based on the data packet is: establishing a communication connection with the object to be detected, constructing a data packet according to the protocol specification, and if communication with the object to be detected can be carried out and all data can be returned, the object to be detected is an industrial control device.

[0011] Preferably, the process of determining whether the object to be detected is an industrial honeypot based on the data packet is: (1) Determine whether the maximum communication session interval with the object to be detected is less than a set threshold. If so, the object to be detected is an industrial honeypot; (2) Determine whether there is a difference between the maximum load of a single data packet of the object to be detected and the set value of the industrial control device. If so, the object to be detected is an industrial honeypot.

[0012] Preferably, the process of judging whether the object to be detected is an industrial honeypot based on the fingerprint of the operating system of the object to be detected is: if the fingerprint is matched in the traffic feature, the object to be detected is an industrial honeypot; The process of scanning and identifying the open services of the object to be detected and determining whether the object to be detected is an industrial honeypot is as follows: scanning and identifying the open services of the object to be detected, if there is a difference between the open service page and the industrial control device page, the object to be detected is an industrial honeypot.

[0013] A method for detecting the concealment of an industrial control honeypot, comprising: An information detection module, used to determine whether the object to be detected is an industrial honeypot based on the information of the object to be detected; the information includes information displayed by the object to be detected and key information; An IP detection module, used to determine whether the object to be detected is an industrial honeypot based on the IP address of the object to be detected; A communication detection module, used to establish a communication connection with the object to be detected, and determine whether the object to be detected is an industrial honeypot based on the data packet; A fingerprint detection module, used to determine whether the object to be detected is an industrial honeypot based on the fingerprint of the operating system of the object to be detected; The open detection module is used to scan and identify the open services of the object to be detected, and determine whether the object to be detected is an industrial honeypot.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The present invention discloses a method for detecting the concealment of an industrial control honeypot, which can improve the accuracy and comprehensiveness of detection. By comprehensively considering the information, IP address, communication data packet, operating system fingerprint, and open service of the object to be detected, the present invention can more comprehensively and meticulously judge whether the object to be detected is an industrial honeypot. Through this method, the weak parts of the industrial control honeypot can be found, and the concealment of the industrial control honeypot can be further improved on this basis. Compared with the detection means of a single dimension, this method can greatly reduce the probability of false alarms and missed alarms, and improve the accuracy and reliability of detection. The method can enhance the concealment of the industrial control honeypot by deeply analyzing the various features of the object to be detected. The method proposed by the present invention is not only applicable to the current industrial control environment, but also has strong adaptability and scalability. With the continuous development of industrial control technology and network attack means, the present invention can continuously improve the judgment of whether the new honeypot is easy to be discovered by updating detection rules and algorithms, and improve the concealment of the industrial control honeypot. At the same time, the implementation process of the method is relatively simple, and it is easy to promote and apply in various industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a flow chart of the method of the present invention; Figure 2 A flow chart of a method for detecting the concealment of an industrial control honeypot provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In the following, the terms "first", "second", "third", and "fourth" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined as "first", "second", "third", and "fourth" may explicitly or implicitly include one or more of the features.

[0017] The co-shooting method provided in the embodiment of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiment of the present application does not impose any restrictions on the specific type of the terminal device.

[0018] It should be noted that the terms "first", "second", etc. in the specification and drawings of the present invention are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] The first aspect of the present invention discloses a method for detecting the concealment of an industrial control honeypot, comprising the following steps: S1, judging whether the object to be detected is an industrial honeypot based on information of the object to be detected; the information includes information displayed by the object to be detected and key information; S2, judging whether the object to be detected is an industrial honeypot based on the IP address of the object to be detected; S3, establishing a communication connection with the object to be detected, and determining whether the object to be detected is an industrial honeypot based on the data packet; S4, judging whether the object to be detected is an industrial honeypot based on the fingerprint of the operating system of the object to be detected; S5, scanning and identifying the open services of the object to be detected, and determining whether the object to be detected is an industrial honeypot.

[0020] In some implementation schemes of the present invention, the information displayed by the object to be detected is judged in S1. If the displayed information is obviously more than that of a normal industrial control networking device, it is preliminarily determined to be an industrial control honeypot.

[0021] According to the key information of the device under test, try to search through cyberspace search engines such as shodan and zoomeye. If security information related to the device under test can be detected, it means that it is a honeypot system.

[0022] In some embodiments of the present invention, in S2, query the service - providing operator corresponding to the IP address of the object to be detected. If the operator belongs to a cloud service operator and the industrial control protocol service is open, the object to be detected can be determined as an industrial control honeypot.

[0023] Query the service - providing operator and organization information corresponding to the IP of the object to be detected, and determine whether it is an industrial control honeypot according to the organization to which it belongs.

[0024] In some embodiments of the present invention, in S3, establish a network connection with it and capture traffic data packets. Then, parse the data - link layer fields in the data packets through Wireshark. According to the fact that industrial control manufacturers have specific exclusive MAC address segments, if keywords such as device models are included in the data packets, the object can be determined as a real industrial control device.

[0025] After establishing a communication connection with the object to be detected, construct data packets respectively according to the function codes involved in the protocol specification. If it can communicate with the object to be detected normally and return normal data, it is a normal industrial control device; if it cannot complete all operations, it is determined as an industrial control honeypot.

[0026] Based on the differences in data compatibility and data - processing coherence between the honeypot and the real industrial control system, try to identify the object to be detected by measuring the communication connection duration and the size of a single - processed data packet: (1) Establish a communication connection with the object to be detected, set the communication interval with the object to be detected, and the communication - interval threshold M. Communicate with the object to be detected normally, gradually increase the communication - interval length until the communication connection is disconnected, and measure the maximum session interval as G. If G < M, the object to be detected is determined as an industrial control honeypot; otherwise, it is determined as a real system. (2) Establish a communication connection with the object to be detected, send a group of data packets, and increase the size of the data packets one by one. Send the data packets in sequence until an error message is returned, and obtain the maximum payload that the object to be detected can process for a single data packet. If the difference between the measured maximum payload of a single data packet and that in the application process of a normal industrial control device exceeds the set threshold, the object to be detected is determined as an industrial control honeypot.

[0027] In some embodiments of the present invention, in S4, detect the operating - system fingerprint of the object to be detected. When the operating system of the IP of the object to be detected is identified as a non - embedded Linux operating system and the device has not undergone routing forwarding and mapping, it is generally considered an industrial control honeypot system.

[0028] Based on the open - source industrial control honeypot, establish an industrial control honeypot fingerprint database. If a fingerprint is matched in the traffic characteristics, it is an industrial control honeypot.

[0029] In some implementation schemes of the present invention, in S5, a scanning tool is used to scan and identify the open services of the object to be detected, query the port information of all open services of the target, view the open service pages, and compare the differences with the real industrial control equipment pages. If the difference value is greater than the set threshold, it is determined whether the object to be detected is an industrial control honeypot.

[0030] If the object to be detected is successfully detected as an industrial control honeypot, it means that its concealment is poor and needs to be modified according to the risk points to improve its concealment.

[0031] The following is further described in conjunction with specific embodiments.

[0032] Industrial control honeypots generally include major industrial control system components, such as DCS, PLC, HMI, RTU, etc. Generally speaking, such devices are rarely connected to the Internet and are only connected to the Internet when required by specific business. In addition, for security reasons, industrial control systems or components that are actually connected to the Internet directly display less information. Therefore, when industrial control devices are found on the Internet, the information they display is first intuitively judged. If the information they display is significantly more than that of normal industrial control networked devices, they are preliminarily judged to be industrial control honeypots.

[0033] Industrial control honeypots are often partially or completely built using virtualization technology and run on Linux systems. Cloud servers are usually used for deployment. Therefore, based on this feature, try to query the service provider corresponding to the IP address. If the IP belongs to a cloud service operator and has opened industrial control protocol services used by PLCs such as Modbus, S7, Ethernet / ip, etc., then the object to be detected can be determined to be an industrial control honeypot, otherwise proceed to subsequent detection steps.

[0034] Query the service provider and organization information corresponding to the IP of the object to be detected through IPIP, network security intelligence community, IP registration query website, etc. If it is found that it belongs to a cloud service provider or a network security provider, the detected object can be determined to be an industrial control honeypot. If it is a traditional manufacturing enterprise or industrial control equipment supplier, continue with subsequent detection.

[0035] According to the key information of the device under test, try to search through cyberspace search engines such as shodan and zoomeye. If security information related to the device under test can be detected, it means that it is a honeypot system.

[0036] Detect the operating system fingerprint of the object to be detected. Industrial control devices are all embedded devices. PLC, DCS, RTU, etc. mostly use real-time operating systems such as vxworks and QNX, and HMI devices usually use wincc operating systems.

[0037] Through TCP / IP operating system fingerprint identification, the TCP / IP protocol stack fingerprint of the target IP is obtained. When the operating system of the target IP is identified as a non-embedded Linux operating system and the device has not been routed, forwarded, and mapped, it can usually be considered an industrial control honeypot system.

[0038] Different industrial control manufacturers have specific exclusive MAC address segments, and the devices they produce can display the corresponding manufacturer or device information based on the MAC address during traffic analysis. In the embodiment provided by the present invention, when determining whether the object to be detected is a honeypot, first establish a network connection with it and capture the traffic data packet, and then parse the data link layer field in the data packet through Wireshark. If it contains keywords such as device model, it can be determined that the object is a real industrial control device.

[0039] Since there are a large number of private protocols in industrial control protocols and their protocol specifications are not disclosed, in the current context, honeypots cannot simulate private protocols and can only realize communication based on open source industrial control protocols. The industrial control protocols involved in the embodiments of the present invention mainly include Modbus protocol, S7 protocol, Profinet protocol, EtherNet / IP protocol, DNP3 protocol, FINS protocol, IEC61850 protocol, IEC104 protocol, OPCUA protocol, BACnet protocol, FFHSE protocol, ICCP protocol, CAN protocol and other 13 mainstream industrial control protocols.

[0040] Based on the open source industrial control honeypot, an industrial control honeypot fingerprint library is established. In the embodiment of the present invention, 9 open source industrial control honeypots such as conpot, MHN, T-pot, GasPot, SCADA honeypot, Gridpot, CryPLH2, Modbus-tk, and Pymodbus are covered. Common industrial control honeypot fingerprints include opening additional ports, field information, return values, etc. For example, when conpot implements S7comm communication, there are fixed value information of fields such as corpright, s7_id, and s7_module_type in the traffic, and the last 6 bytes of the application data for obtaining device information returned by S7 are always "\x00\x00\x00\x00\x00\x00", and when implementing the communication of the Enip protocol, when sending the 63 function code to the device to obtain the device information, the content of the returned data device_status field is "\x60\x31" or "\xff".

[0041] Use the nmap scanning tool to scan and identify the open services of the object to be detected, query all the open port information of the target, access the service page through the browser at http: / / ip:port and https: / / ip:port, and query whether there is a relevant service page for the relevant industrial control components. If there are differences in the main content between the service page and the real industrial control equipment, it is determined that the object to be detected is an industrial control honeypot, and the honeypot simulation application page needs to be further modified to improve the system concealment.

[0042] There are often problems with incomplete functions in the implementation of the protocol functions of industrial control honeypots. After establishing a communication connection with the object to be detected, construct data packets according to the function codes involved in the protocol specification respectively. If normal communication can be established with the object to be detected and normal data can be returned, it indicates that the object to be detected is similar to the real industrial control equipment in terms of functions. In the implementation process of the present invention, a large part of the honeypots based on openplc can be detected. This type of honeypot only implements Modbus function codes 1-16, and the rest of the function codes such as function code 17, function code 43, and 90 private function codes are not implemented.

[0043] Defects in the real-time data processing, data processing capabilities, and availability of honeypot data lead to incomplete protocol processing at the application layer for open source protocols. There are significant gaps in data compatibility and data processing coherence compared to real industrial control data. To ensure the honeypot data processing performance, it usually adopts communication connection duration limits and data packet size limits to detect the communication connection duration limit and single data packet size limit for the device under test: (1) Establish a communication connection with the object to be detected, set the communication interval with the object to be detected, with an initial value of 1 second, and the communication interval threshold M. Communicate with the object to be detected normally, send data packets every 1 second. If data is returned normally and the session connection is maintained, it indicates normal communication; increase the communication interval by 1 second each time and repeat the communication; when the communication interval is G and the session is disconnected, it indicates that the maximum session interval of the object to be detected is G. If G < M, it indicates that the object to be detected is very likely to be an industrial control honeypot, otherwise it is more likely to be a real system. In the embodiment of the present invention, the set communication interval threshold is 60 seconds, and the longest waiting delay of the Conpot honeypot is 5 seconds. After 5 seconds, the connection is automatically disconnected, and subsequent messages will get abnormal responses.

[0044] (2) Establish a communication connection with the object to be detected, send a group of data packets, and the payload of each data packet is 1 byte larger than the previous one. Send the data packets in sequence until an error message is returned, and obtain the maximum processing of the payload of a single data packet of the object to be detected If the object to be detected is successfully detected as an industrial control honeypot, it indicates that its concealment is poor and it needs to be modified according to the risk points to improve the concealment.

[0045] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting the concealment of an industrial control honeypot, characterized in that: The following steps are involved: Determine whether the object to be detected is an industrial honeypot based on the information of the object to be detected; the information includes information displayed by the object to be detected and key information; Determine whether the object to be detected is an industrial honeypot based on the IP address of the object to be detected; Establishing a communication connection with the object to be detected, and determining whether the object to be detected is an industrial honeypot based on the data packet; Based on the fingerprint of the operating system of the object to be detected, determining whether the object to be detected is an industrial honeypot; Scan and identify the open services of the object to be detected, and determine whether the object to be detected is an industrial honeypot.

2. According to claim 1, a method for detecting the concealment of an industrial control honeypot is characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on the information displayed by the object to be detected is: judging the information displayed by the object to be detected, and if the displayed information is more than the networked industrial control equipment, judging that the object to be detected is an industrial control honeypot.

3. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on key information is: searching through a cyberspace search engine, and if security information related to the object to be detected is detected, judging that the object to be detected is an industrial control honeypot.

4. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on the IP of the object to be detected is as follows: if the service provider corresponding to the IP address of the object to be detected is a cloud service operator and the operator has opened the industrial control protocol service, then the object to be detected is an industrial control honeypot.

5. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on the IP of the object to be detected is as follows: if the service provider corresponding to the IP of the object to be detected provides operator and organization information, judging whether the object to be detected is an industrial honeypot according to the organization information.

6. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of determining whether the object to be detected is an industrial honeypot based on the data packet is as follows: establishing a communication connection with the object to be detected, detecting whether the keywords in the data link layer field in the data packet contain keywords related to the device, and if so, the object to be detected is an industrial control device.

7. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of determining whether the object to be detected is an industrial honeypot based on the data packet is as follows: establishing a communication connection with the object to be detected, constructing a data packet according to the protocol specification, and if communication with the object to be detected can be carried out and all data can be returned, the object to be detected is an industrial control device.

8. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on the data packet is as follows: (1) Determine whether the maximum communication session interval with the object to be detected is less than a set threshold. If so, the object to be detected is an industrial honeypot; (2) Determine whether there is a difference between the maximum load of a single data packet of the object to be detected and the set value of the industrial control device. If so, the object to be detected is an industrial honeypot.

9. The method for detecting the concealment of an industrial control honeypot according to claim 1, characterized in that: The process of judging whether the object to be detected is an industrial honeypot based on the fingerprint of the operating system of the object to be detected is as follows: if the fingerprint is matched in the traffic characteristics, the object to be detected is an industrial honeypot; The process of scanning and identifying the open services of the object to be detected and determining whether the object to be detected is an industrial honeypot is as follows: scanning and identifying the open services of the object to be detected, if there is a difference between the open service page and the industrial control device page, the object to be detected is an industrial honeypot.

10. A method for detecting the concealment of an industrial control honeypot, characterized in that: include: An information detection module, used to determine whether the object to be detected is an industrial honeypot based on the information of the object to be detected; the information includes information displayed by the object to be detected and key information; An IP detection module, used to determine whether the object to be detected is an industrial honeypot based on the IP address of the object to be detected; A communication detection module, used to establish a communication connection with the object to be detected, and determine whether the object to be detected is an industrial honeypot based on the data packet; A fingerprint detection module, used to determine whether the object to be detected is an industrial honeypot based on the fingerprint of the operating system of the object to be detected; The open detection module is used to scan and identify the open services of the object to be detected, and determine whether the object to be detected is an industrial honeypot.

Images