An industrial control system attack path identification method based on alarm sequence probability

Abstract

The application belongs to the field of industrial internet information security, and discloses an industrial control system attack path identification method based on alarm sequence probability. On the basis of attack graph technology, the vulnerability life cycle and alarm correlation analysis are comprehensively used to realize efficient and accurate attack path identification. The reachable information and vulnerability information existing in the topology relationship between each host of the industrial control system are collected, and the node state transition in the topology is quantified based on the vulnerability level. The alarm information obtained by the intrusion detection system is introduced and matched to the corresponding node, so as to better fit the real attack, and finally the dynamic attack intention posterior estimation inference and attack path reverse search are carried out on the obtained probability attack graph, and the dynamic risk assessment of the potential attack path of the industrial control system is realized. The heuristic path identification method improves the identification reliability and accuracy by reconstructing the attack graph, which is beneficial to the concentrator to concentrate limited resources for key node protection.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet information security, and specifically to a method for identifying attack paths of industrial control systems based on alarm sequence probability. Background Art

[0002] In recent years, with the development of industrial Ethernet and wireless interconnection technologies, industrial control systems (ICS) have gradually evolved from a closed and isolated state to an open and interconnected one. This has greatly improved system flexibility and scalability, driving the automation and intelligentization of production. However, due to the low security, high real-time requirements, and the conflicting security and economic benefits of ICS systems, they are more vulnerable to attacks than traditional IT systems. Security incidents in this area occur frequently, such as the XZ Utils supply chain attack targeting industrial software, the BlackBasta ransomware attack against Swiss automation giant ABB, and man-in-the-middle attacks against Siemens S7 PLCs. Protecting ICS systems is urgent. Traditional approaches rely primarily on intrusion detection technology to analyze the vulnerabilities of individual nodes in an ICS in isolation. However, in reality, nodes in ICS networks are interconnected and interact with each other. Attackers can exploit the connections between networks to infiltrate, penetrate, and move, ultimately launching attacks on critical assets and disrupting industrial processes.

[0003] An attack graph is a vulnerability assessment method based on graph theory. It is a directed network diagram formed by integrating network configuration, vulnerability information, and inter-host relationships. Vertices typically represent elements such as hosts, services, vulnerabilities, and permissions, while directed edges represent changes between these elements. Using an attack graph, one can visually visualize all possible attack paths and is suitable for multi-stage, multi-step network attacks. During an attack, an attacker, based on their initial permissions, exploits a vulnerability to gain access to a node, then successively compromises other nodes, ultimately invading the target node in the network. Using an attack graph, one can effectively identify potential attack paths from the attacker's perspective and focus limited resources on targeted defenses. Existing methods for identifying attack paths using attack graphs mainly include: exhaustive methods, which use graph traversal algorithms such as depth-first or breadth-first to list all possible paths. This is computationally very complex for large networks; and simplified methods, which effectively reduce the number of redundant and meaningless attack paths by limiting the maximum number of steps or creating localized attack graphs based on key assets. However, this also results in topological changes and the loss of critical information. The present invention adopts attack path identification based on alarm sequence, which is essentially a heuristic graph search method. It uses alarm information to perform a posteriori estimation and infer attack intent, thereby identifying effective attack paths. Summary of the Invention

[0004] To address the shortcomings of existing attack path identification methods, this paper provides an industrial control system attack path identification method based on alarm sequence probability. This method leverages attack graph technology to integrate vulnerability lifecycle and alarm correlation analysis to achieve efficient and accurate attack path identification.

[0005] The technical solution of the present invention is as follows: a method for identifying attack paths of industrial control systems based on alarm sequence probability, comprising the following steps:

[0006] Step 1: Reachability analysis;

[0007] Conduct reachability analysis on the logical and physical dependencies between host nodes in the industrial control system network, and collect industrial control system accessibility information, system vulnerability information, and intrusion detection system data;

[0008] Step 2: Modeling the basic elements of the attack;

[0009] Define an attribute attack graph, which is obtained by correlating the industrial control system accessibility information and system vulnerability information collected in step 1 of the reachability analysis. This graph is used to show the attacker's goals and potential complete attack paths.

[0010] Step 3: Calculate the node transfer probability and node reachability probability;

[0011] Step 4: Generate a probabilistic attack graph based on the alarm information;

[0012] According to the definition of attack elements in the attribute attack graph in step 2 and the node transfer probability in step 3, a probabilistic attack graph is generated based on the attribute attack graph based on the idea of ​​graph traversal;

[0013] Step 5: Dynamic attack path identification;

[0014] Using the probabilistic attack graph generation method introduced in step 4, at the initial time t (0) When there is no alarm, a probabilistic attack graph is generated, and the reachability probability of each prior node and the reachability probability of the posterior node are calculated; the reachability probability of each target attribute node and the target attribute node with the largest probability are compared, and the target attribute node with the largest probability is the maximum attack intention; starting from the maximum attack intention, the reverse depth search algorithm is used to search for the node with the largest posterior node reachability probability in the parent node, and add it to the attack path until the initial attribute node is added to the attack path, forming t (0) The maximum probability attack path Path_0 at the moment; the next moment t (1) , generate alarm information o i (1), update the posterior reachability probability and maximum attack intention of each node, and use the updated maximum attack intention as the starting point to reversely search the alarm node or the node with the largest posterior reachability probability in the parent node, and add it to the attack path at the current moment to form t (1) The maximum probability attack path Path_1 at time t (2) -t (t) Repeat the above process at all times and finally output t (t) The maximum attack intention at the moment and the attack path with the maximum probability Path_t.

[0015] The attribute attack graph contains two basic elements: nodes and directed edges. The nodes represent the status information of the industrial control system, including host attributes, atomic attacks, and alarm information, corresponding to attribute nodes s, attack nodes a, and alarm nodes o respectively. The directed edges represent the utilization relationship between nodes, that is, the state migration from one node to another. According to the different types of nodes connected by the directed edges, the directed edges are divided into the prerequisite directed edges E from the attribute node s to the attack node a. S×A And the post-result directed edge E from attack node a to attribute node s A×S Two major categories.

[0016] The attribute attack graph is defined as a binary Att_G=<N,E> , where Att_G represents the attack graph, N is the node set, and E is the directed edge set;

[0017] The node set N is defined as triples N =<S,A,O> , S is the attribute node set, which represents the permissions owned or available before and after the attack, consisting of the initial node set S0, the target node set S d , process node set S I Composition: S = S0 ∪ S I ∪S d , the basic form is:

[0018] S={s i |s i =(id_s i ,ip_s i ,privilege)}

[0019] Among them, id_s i Represents attribute node s i Number, ip_s i Indicates s i The IP address of the privileged i permissions possessed or acquired;

[0020] A is the atomic attack set. In the attribute attack graph, an atomic attack refers to an indivisible attack action performed by an attacker using a vulnerability. This attack action is not affected by the relationship between nodes. The basic form is:

[0021] A={a i |a i =(id_a i ,ip_a i ,id_vul,level_vul)}

[0022] where id_a i Indicates attack node a i Number, ip_a i Indicates a i The IP address of the i The vulnerability number of the attack. level_vul indicates the vulnerability level published, which is divided into high-level H, medium-level M, and low-level L.

[0023] O is the warning sequence, for a certain attack a i , if there is o i ->a i , that is o i Can be mapped to attack a i If it is above, it means there is an alarm message. i ∈O; the basic form of the alarm sequence is:

[0024] O={o i |o i =(time,id_o i ,ip_o i ,ids_class)}

[0025] Where time indicates the occurrence of an alarm o i Time, id_o i Indicates o i Number, ip_o i Indicates o i IP address, ids_class indicates the alarm information is generated. i The type of IDS;

[0026] The directed edge set E is defined as the pair E= <E S×A ,E A×S >, E S×A is a set of prerequisite directed edges, connecting the attribute node s to the attack node a, indicating that the attacker must have the permissions on the attribute node, i.e., the prerequisite, to carry out this atomic attack; the basic form is:

[0027] E S×A ={e ij |eij =(id_s i ,ip_s i ,id_a j ,ip_a j ,p ij )}

[0028] where e ij Indicated by attribute node s i Pointing to attack node a j Directed edge, id_s i ip_s i Respectively represent s i Number and IP address, id_a j ip_a j Respectively represent a j Number and IP address, p ij Indicates attachment to e ij The weight between the two, its physical meaning is the attribute node s i With attack node a j The probability of successful transfer between

[0029] E A×S is a directed edge set of post-results, connecting the attack node a to the attribute node s, indicating that the attacker obtains the subsequent attribute node permissions after executing an atomic attack;

[0030] E A×S ={e ij |e ij =(id_a i ,ip_a i ,id_s j ,ip_s j ,p ij )}

[0031] where e ij Indicates that the attack node a i Points to attribute node s j Directed edge, id_a i ip_a i Respectively represent a i Number and IP address, id_s j ip_s j Respectively represent s j Number and IP address, p ij Indicates attack node a i To attribute node s j The probability of successful transfer.

[0032] The node transition probability refers to the probability of state migration of the nodes at both ends of the directed edge of the attribute attack graph along the directed edge; the node transition probability is a real number in the range of 0-1 attached to the directed edge, including the node transition probability attached to the precondition directed edge and the node transition probability attached to the postcondition directed edge;

[0033] The node transfer from attribute node s to attack node a is regarded as an atomic attack launched by using the host attribute on attribute node s. The node transfer probability is equivalent to the attack occurrence probability, that is, the attack occurrence probability is mapped to the premise condition directed edge E S×A The attack probability is calculated as follows: the atomic attack probability output by the basic metric group of the common vulnerability scoring system that introduces the host impact factor is multiplied by the time impact factor output by the vulnerability lifecycle model;

[0034] The node transfer from attack node a to attribute node s is regarded as a successful atomic attack on the host and obtains the host attribute. At this time, the node transfer probability is equivalent to the attack success probability, that is, the attack success probability is mapped to the post-result directed edge E A×S Based on the node transfer probability, the attack success probability is calculated according to the vulnerability classification.

[0035] The basic metric group of the universal vulnerability scoring system that introduces host impact factors is Att_Ato i =2×v×AV×AC×Au,Att_Ato i is the atomic attack probability, and the subscript represents the i-th vulnerability;

[0036] v is the host impact factor, which varies depending on the host type. The difficulty of vulnerability attacks is as follows: database, server, PC, PLC, and the corresponding host impact factors are set to 0.625, 0.750, 0.875, and 1.000;

[0037] AV is the attack vector in the Common Vulnerability Scoring System's base metric group, describing the attack methods used by attackers. It includes three types: local attack, adjacent network attack, and network attack. CVSS specifies that the corresponding values ​​for AV are 0.395, 0.646, and 1.000, respectively.

[0038] AC is the attack complexity in the basic metric group of the Common Vulnerability Scoring System, which describes the complexity of the attacker's attack on the vulnerability, including high complexity, medium complexity, and low complexity. The corresponding values ​​of AC are specified as 0.350, 0.610, and 0.710 respectively;

[0039] Au is the identity authentication in the basic metric group of the Common Vulnerability Scoring System, which describes whether the attacker needs to pass identity authentication or the number of authentications when attacking, including multiple authentications, single authentication, and no authentication required. The corresponding values ​​of Au are specified as 0.450, 0.560, and 0.704 respectively.

[0040] The vulnerability life cycle model is expressed as:

[0041]

[0042] According to the system vulnerability information obtained from the reachability analysis, the dates of the latest and oldest vulnerabilities in the industrial control system are recorded in days, and the date difference is recorded as the time span of the system vulnerability △year. All vulnerability information collected by NVD within the time span △year is collected, including vulnerability classification information as L, M, H, and information on status changes with the year; P of different vulnerability levels is calculated respectively. (level) λ1-λ6 in:

[0043]

[0044]

[0045] λ3=1-λ2-λ4,λ6=1-λ5

[0046] After obtaining the parameters of the vulnerability lifecycle management model, time reasoning is performed in days. At the initial time t0, the state probability distribution vector SV (0) =[1,0,0,0,0], after t days, SV (t) =SV (0) ×P t , where SV (t) (4) represents the probability that the vulnerability is in S4, i.e., the exploitable state, after t days; define the time impact factor. For vulnerability i on the host, its time impact factor after t days Among them level i Indicates the level of vulnerability i.

[0047] The node reachability probability is a measure of the overall probability of an attacker successfully reaching the node; attribute attack graph association structure reasoning is performed, and the connection relationship is divided into sequential relationship, conjunction relationship, and disjunction relationship according to the different parent-child node connections; the node reachability probability is calculated by a top-down recursive method, and the child node reachability probability is calculated based on the parent node reachability probability, the parent-child node transfer probability, and the parent-child node association relationship; based on the node definition and the association relationship between the nodes obtained by reasoning, a directed link is defined from the initial node through the transition node to the target node; the directed link is composed of the above-mentioned nodes and the directed edges associated therewith, and the directed link is regarded as an attack path.

[0048] The a priori node reachability probability refers to the node reachability probability when the attack node does not have an alarm node mapped to it; the a posteriori node reachability probability refers to the node reachability probability when the attack node has an alarm node mapped to it; the relationship between the a posteriori node reachability probability and the a priori node reachability probability is:

[0049]

[0050] Among them, P(a i ) represents the prior probability of reachability, P(a i |o i ) represents the posterior reachability probability, d i Indicates the detection rate of the IDS corresponding to the alarm node, u i Represents the false alarm rate of the IDS corresponding to the alarm node. The probabilistic attack graph is equivalent to exhaustively enumerating the child nodes of each attribute node and attack node based on the industrial system's reachable information and matching them with the parent node until all nodes are traversed. Simultaneously, the alarm information generated by the IDS deployed at each layer of the industrial control system network is used to indicate attack behavior information occurring on the host. The probability of a valid alarm information corresponding to an atomic attack is high. Based on the generated probabilistic attack graph, a mapping between alarm nodes and atomic attack nodes is established to reconstruct the probabilistic attack graph, ultimately identifying the attack path with the highest probability.

[0051] The industrial control system accessible information specifically includes the detailed configuration of each host, the type of service running, the trust relationship between hosts, and the network topology; the intrusion detection system data specifically includes IDS performance data, firewall access control and filtering rules; the system vulnerability information specifically includes the vulnerability information existing on each host of the industrial control system.

[0052] The beneficial effects of the present invention are as follows: first, the alarm information generated by the intrusion detection system is introduced into the dynamic identification of the attack graph, and the probabilistic attack graph is reconstructed using posterior estimation to improve the reliability and accuracy of path identification; second, for single vulnerability atomic attacks, a vulnerability life cycle based on an absorbing Markov chain is established, and it is used as a time domain influencing factor to map to the node transfer probability, thereby compensating for the lack of consideration of time factors or the overly simple time model in existing methods; third, the correlation structure between attack graphs is comprehensively summarized, including the sequential, disjunctive and conjunction relationships, making the attack graph model more practical. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a structural diagram of an industrial control system attack path identification method based on alarm sequence probability according to the present invention;

[0054] Figure 2This is a flow chart of an industrial control system attack path identification method based on alarm sequence probability of the present invention;

[0055] Figure 3 The present invention is based on the vulnerability life cycle state transition diagram of the absorbing Markov chain;

[0056] Figure 4 This is a schematic diagram of the various association relationships of the network topology of the present invention;

[0057] Figure 5 This is a network topology diagram of an industrial control system according to an embodiment of the present invention;

[0058] Figure 6 This is a probability attack graph when no alarm information is generated according to an embodiment of the present invention;

[0059] Figure 7 The figure is a schematic diagram of a dynamic attack path identification process based on an alarm sequence according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0061] In a basic implementation of the present invention, there are five steps involved. Based on the industrial control system network topology, the attacker's most likely attack nodes and paths are ultimately identified online. The specific implementation steps are as follows:

[0062] Step 1: Reachability Analysis

[0063] Perform reachability analysis on the logical and physical dependencies between host nodes in the industrial control system network, collecting information on industrial control system accessibility, system vulnerability information, and intrusion detection system (IDS) data. This information includes detailed configuration of each host, the types of services running, trust relationships between hosts, network topology, IDS performance data, firewall access control and filtering rules, and information on host vulnerabilities.

[0064] Industrial control system accessibility information: Use the host scanning tool Nmap to obtain the applications, services and their corresponding port numbers running on each host node. There is information and data transmission and dependence between different hosts with the same port, and they can be regarded as "connected", that is, there is a reachable relationship between the two. Combined with firewall filtering and access control rules, and the trust relationship between hosts, the network topology can be comprehensively determined. The accessibility information can be represented in the form of a 0-1 square matrix, where the rows and columns represent the industrial control host numbers respectively. The element value of 0 indicates that the host corresponding to the row number is not connected to the host corresponding to the column number, and 1 indicates that it is connected. For an industrial control system with N hosts, the corresponding reachability matrix is ​​P_Reach[N×N], where the element P_Reach ijIt means that the i-th host can reach the j-th host, and the diagonal elements of the P_Reach matrix are all 1. The reachable access matrix of the embodiment is as follows:

[0065]

[0066] System vulnerability information: The vulnerability scanning tool Nessus is used to scan system vulnerabilities, and the National Vulnerability Database (NVD) is used to uniformly describe the vulnerabilities, including the Common Vulnerabilities and Exposures (CVE) identifier and the Common Vulnerability Scoring System (CVSS) score. For all published vulnerabilities, there is a unique "identity card" in the format of: CVE-year of vulnerability disclosure-number of the year. In addition, for each vulnerability, NVD will also use the three sub-metric groups of foundation, time, and environment to comprehensively consider the exploitability, impact, etc. to derive a severity score of 0-10, with 0 being the lowest and 10 being the highest. Taking the Windows SMB protocol vulnerability exploited by the ransomware WannaCry as an example, its CVE identifier is CVE-2017-0144 and its CVSS score is 8.8 (HIGH). Based on the above, the host vulnerability data is finally output, and the host vulnerability configuration information of the embodiment is shown in Table 1.

[0067] Table 1 Host vulnerability configuration information table of the embodiment

[0068]

[0069] Intrusion Detection System (IDS) data. Obtain historical data on IDS detection rates, false positive rates, missed negative rates, and other indicators of attacked hosts. This provides a data source for subsequent alert-based reachability. The magnitude of each indicator depends on the IDS detection method and the host type (PC, PLC, database, server, etc.).

[0070] Step 2: Modeling the basic attack elements

[0071] An attack graph is a directed graph that uses network reachability topology and vulnerability relationships for correlation analysis, visualizing attacker targets and potential complete attack paths. An attack graph consists of basic elements such as nodes and directed edges. Nodes represent elements such as host attributes, atomic attacks, and alert information, while directed edges represent the exploitation relationships between nodes, i.e., the migration from one node to another. To achieve dynamic prediction of attack paths based on alerts, after performing reachability analysis, the basic elements of the attack model must be modeled.

[0072] (1) Basic definition of attack graph

[0073] According to the different definitions of nodes and directed edges and the different relationships between them, it can be divided into two categories: state attack graph and attribute attack graph. The present invention uses attribute attack graph, which is defined as the binary Att_G =<N,E> , where Att_G represents the attack graph, N is the node set, and E is the directed edge set.

[0074] (2) Node set N

[0075] The node set N is defined as triples N =<S,A,O> , S is the attribute node set, which represents the permissions owned or available before and after the attack, consisting of the initial node set S0, the target node set S d , process node set S I Composition: S = S0 ∪ S I ∪S d , the basic form is:

[0076] S={s i |s i =(id_s i ,ip_s i ,privilege)}

[0077] where id_s i Represents attribute node s i Number, ip_s i Indicates s i The IP address of the privileged i Permissions possessed or acquired.

[0078] A is the atomic attack set. In the attack graph, an atomic attack (Network Atomic Attack, NAA) refers to an indivisible attack action performed by an attacker using a vulnerability. This attack action is not affected by the relationship between nodes. The basic form is:

[0079] A={a i |a i =(id_a i ,ip_a i ,id_vul,level_vul)}

[0080] where id_a i Indicates attack node a i Number, ip_a i Indicates a i The IP address of the i The vulnerability number of the attack. Here, the CVE vulnerability unified identifier published by NVD is used. level_vul indicates the level of the vulnerability published by NVD, which is divided into high (H), medium (M), and low (L).

[0081] O is the warning sequence, for a certain attack a i , if there is a corresponding matching o i ->a i , then there is an alarm message o i ∈O. It reflects that the IDS intrusion detection system in the real industrial control network successfully detects a vulnerability attack and issues an alarm. The basic form is:

[0082] O={o i |o i =(time,id_o i ,ip_o i ,ids_class)}

[0083] Where time indicates the occurrence of an alarm o i Time, id_o i Indicates o i Number, ip_o i Indicates o i IP address, ids_class indicates the alarm information is generated. i The type of IDS.

[0084] (3) Directed edge set E

[0085] The directed edge set E is defined as the pair E= <E S×A ,E A×S >, E S×A It is a set of precondition directed edges, connecting the attribute node s to the attack node a, indicating that the attacker must have the permissions on the attribute node, which is the precondition, to carry out this atomic attack. The basic form is:

[0086] E S×A ={e ij |e ij =(id_s i ,ip_s i ,id_a j ,ip_a j ,p ij )}

[0087] where e ij Indicated by attribute node s i Pointing to attack node a j Directed edge, id_s i ip_s i Respectively represent s i Number and IP address, id_a j ip_a j Respectively represent a j Number and IP address, p ij Indicates attachment to eij The weight between the two, its physical meaning is the attribute node s i With attack node a j The probability of a successful transfer between .

[0088] E A×S It is a directed edge set of post-results, connecting the attack node a to the attribute node s, indicating that the attacker obtains the subsequent attribute node permissions after executing an atomic attack. The basic form is:

[0089] E A×S ={e ij |e ij =(id_a i ,ip_a i ,id_s j ,ip_s j ,p ij )}

[0090] where e ij Indicates that the attack node a i Points to attribute node s j Directed edge, id_a i ip_a i Respectively represent a i Number and IP address, id_s j ip_s j Respectively represent s j Number and IP address, p ij Indicates attack node a i To attribute node s j The probability of successful transfer.

[0091] Step 3: Calculate node transfer probability and node reachability probability

[0092] The node transition probability refers to the probability of state migration of the nodes at both ends of the directed edge of the attribute attack graph along the directed edge; the node transition probability is a real number in the range of 0-1 attached to the directed edge, including the node transition probability attached to the precondition directed edge and the node transition probability attached to the postcondition directed edge;

[0093] The node transfer from attribute node s to attack node a is regarded as an atomic attack launched by using the host attribute on attribute node s. The node transfer probability is equivalent to the attack occurrence probability, that is, the attack occurrence probability is mapped to the premise condition directed edge E S×A The attack probability is calculated as follows: the atomic attack probability output by the basic metric group of the common vulnerability scoring system that introduces the host impact factor is multiplied by the time impact factor output by the vulnerability lifecycle model;

[0094] The node transfer probability between the attack node a and the attribute node s is equivalent to a successful attack on the host in the actual system. Similarly, the attack success probability can be mapped to the post-result edge E A×S Based on the transfer probability, the attack success probability is calculated according to the vulnerability classification.

[0095] Define the node reachability probability to measure the overall probability of an attacker successfully reaching that node. Perform attribute attack graph association structure reasoning. Based on the differences in parent-child node connections, connection relationships can be categorized into three types: sequential, conjunction, and disjunction. Based on the node definitions and the inferred association relationships between nodes, define a directed link from the initial node through the transition node to the target node. This link consists of the aforementioned nodes and the directed edges connecting them. This link can be considered an attack path.

[0096] (1) Node transfer probability

[0097] To calculate the reachability probability of each node in the attack graph and thus predict the attack path, we need to calculate the node transition probability attached to each directed edge. Depending on the type of directed edge, the attack occurrence and success probabilities can be mapped to the probabilities of the precondition and postcondition directed edges, respectively. Below, we calculate the attack occurrence and success probabilities, respectively.

[0098] An atomic attack is equivalent to a vulnerability exploit. The difficulty of exploiting a vulnerability is negatively correlated with the probability of an attack. The harder the vulnerability is to exploit, the lower the probability of an attack. The Common Vulnerability Scoring System Basic Metrics Group defines a vulnerability exploitability equation, including metrics such as Access Vector (AV), Access Complexity (AC), and Authentication (Au). However, it does not consider the impact of the host on exploitability. This paper introduces a host impact factor v and calculates the probability of an atomic attack (hereinafter referred to as the atomic attack probability) based on the improved exploitability equation:

[0099] Att_Ato i =2×v×AV×AC×Au

[0100] Where, the subscript represents the i-th vulnerability, and the calculation methods of v, AV, AC, and Au are shown in Table 2.

[0101] Table 2 Calculation of atomic attack probability factors

[0102]

[0103] The probability of an attack not only depends on the atomic attack probability, but also on the time factor. The longer the vulnerability is discovered, the higher the possibility of its exploitation. We introduce the time impact factor to quantify the degree of vulnerability impact by time. The following is the calculation and reasoning of the time exploitation probability. We establish a vulnerability life cycle model and divide the vulnerability status into "generation", "discovery", "exploitation", and "failure". The complete life cycle of a vulnerability will start from generation, be discovered and disclosed over time, and finally be exploited or failed. The vulnerability life cycle state transition diagram is shown below. Figure 3 shown.

[0104] Since the vulnerability life cycle states are discrete, have no aftereffects, and have two target states, they are consistent with the absorbing Markov chain. Therefore, a vulnerability life cycle model based on the absorbing Markov chain can be established. The generation, discovery, and disclosure are used as the transition states S1, S2, and S3 of the absorbing Markov chain, and the two target states of exploitation and failure are used as the absorbing states S4 and S5. The vulnerability life cycle model established by combining the absorbing Markov chain and the state transition diagram can be expressed as follows:

[0105]

[0106] According to the time span △year of each host vulnerability in the embodiment obtained in step 1, all vulnerability information collected by NVD within the time span △year is collected, including vulnerability classification information (L, M, H) and information on status changes over the year, and P of different vulnerability levels is calculated respectively. (level) λ1-λ6 in:

[0107]

[0108] λ3=1-λ2-λ4,λ6=1-λ5

[0109] After obtaining the parameters of the vulnerability lifecycle management model, time reasoning is performed in days. At the initial time t0, the state probability distribution vector SV (0) =[1,0,0,0,0], after t days, SV (t) =SV (0) ×P t , where SV (t) (4) represents the probability that the vulnerability is in S4, i.e., exploitable state, after t days. In summary, the time impact factor is defined. For vulnerability i on the host, its time impact factor after t days is Among them level i Indicates the level of vulnerability i.

[0110] After calculating the atomic attack probability and time impact factor, the attack occurrence probability attached to the precondition is also derived, and the attack success probability is then calculated. In actual attacks, the attack occurrence probability and attack success probability are related. Whether a vulnerability attack occurs and succeeds is related to the difficulty of the vulnerability attack, and the attack difficulty is already factored into the attack occurrence probability. Therefore, conventional methods treat the success probability as 1. To maintain generality, this invention assigns different attack success probabilities (0.8, 0.9, 1) to vulnerabilities of different levels (H, M, L) based on historical data.

[0111] The node transition probability can finally be expressed as:

[0112]

[0113] (2) Node reachability probability

[0114] Node transition probability p ij It represents the difficulty of state transfer between different nodes and depends only on the atomic attack on the host and its corresponding individual factors, and has nothing to do with the causal relationship of the network topology. The node reachability probability measures the overall probability that an attacker can successfully reach the node in a given attack graph. It is represented by the capital letter P. The node reachability probability takes into account the association structure between nodes. The calculation of the reachability probability between different association structures will be introduced in Section (3).

[0115] (3) Attack graph association structure

[0116] First, we use Pre(ai / si) to represent the parent node of node ai / si, and Post(ai / si) to represent the child node of node ai / si. Similar to the intersection and union of random events, we divide parent and child nodes into successive, conjunction, and disjunction relationships based on the number of connected directed edges and node distribution.

[0117] In the succession relationship, a single node is connected to a single node, and the parent and child nodes are uniquely connected. The succession relationship is the simplest form. i Probability of reaching P(a i ), when s j =Post(a i ) and a i =Pre(s j ), the child node s j Reachability probability P(s j )=P(a i )p ij , similarly, we can find the known parent node s i Child node a is reachable with probability j The probability of being reachable.

[0118] In conjunction relationship, multiple nodes are connected to a single node. According to the difference between parent and child nodes, it can be divided into multiple attack nodes connected to a single attribute node, or multiple attribute nodes connected to a single attack node. The classification is explained below. Multiple attack nodes are connected to a single attribute node. If any attack node is reachable, the attribute node is reachable. The attribute node reachability probability can be expressed as: s j =Post(a i ),i=1,2,…,n,n≥2, it is known that each P(a i ), When multiple attribute nodes are connected to a single attack node, the attack node is reachable only when all attribute nodes are reachable. The reachability probability of the attack node can be expressed as: j =Post(s i ),i=1,2,…,n,n≥2, it is known that each P(s i ),

[0119] In a disjunctive relationship, a single node is connected to multiple nodes. There is a connection between the parent node and each child node. Each child node has a unique parent node, which can be regarded as a combination of multiple successive relationships. The disjunctive relationship is independent of the type of parent and child nodes. For example, taking the attribute node as the parent node and the attack node as the child node, calculate the reachability probability of each child node: s i =Pre(a j ),j=1,2,…,n,n≥2, it is known that P(s i ),right P(a j )=P(s i )p ij ,j=1,2,…,n. Similarly, we can calculate the reachability probability of each child node when the attack node is the parent node and the attribute node is the child node.

[0120] The above-mentioned relationship diagrams are as follows Figure 4 shown.

[0121] (4) Attack Path

[0122] The attack path represents the directed link from the initial attribute node to the transition attribute node and finally to the target attribute node. The link consists of the above nodes and the directed edges associated with them. It is defined as the attack path Path, Path = ⊥→s0→a1→…→s d , for any element τ in Path i (τ i ∈S or A) have τ i+1 =Post(τ i )∈Path, let l=Length(Path) be the sum of all nodes passed by the path, representing the attack path length, np is the number of attack paths, then s0 to s dThe set of all attack paths is PATHS={Path (1) ,Path (2) ,...,Path (np)}.

[0123] Step 4: Generate an attack graph based on the alert information

[0124] According to the definition and calculation of attack elements and association rules, a probabilistic attack graph is generated based on the idea of ​​graph traversal. Its essence is equivalent to exhaustively enumerating the child nodes and matching the parent nodes for each attribute node and attack node according to the reachable relationship of the network topology until all nodes are traversed. In order to facilitate analysis and fit the actual system at the same time, the following assumptions are made: Assumption 1: The attacker has "memory", and the attribute nodes that have obtained permissions will not be re-acquired through attacks, that is, the attack graph is acyclic; Assumption 2: Atomic attacks will only occur when all the prerequisite attribute node permissions of the attack node are met; Assumption 3: When any prerequisite attack node of an attribute node is met, the permission of the attribute node will be obtained. For the embodiment, the probabilistic attack graph is generated from the network topology structure as shown in the following example. Figure 6 As shown in the figure, the initial attribute node represents the attacker's position and permissions before the attack, the target attribute node represents the attacker's intention, and the transition attribute nodes and attack nodes represent nodes that may be exploited or reached along the attack path. There are 24 attack paths from the initial to the target attribute node, with the shortest path length being 8 and the longest path length being 16.

[0125] The alarms generated by IDSs deployed at various layers of the industrial control network can be used to indicate attack behaviors occurring on hosts. A valid alarm message probabilistically corresponds to an atomic attack. Therefore, based on the attack graph generated above, a mapping between alarm nodes and atomic attack nodes can be established to reconstruct the probabilistic attack graph and ultimately identify the attack path with the highest probability.

[0126] For attacking node a i =(id_a i ,ip_a i ,id_vul,level_vul), if IDS detects the existence of the attack at a certain moment, it will generate a corresponding i Warning information o i =(time,id_alerm,ip_alerm,ids_class), and the two IP values ​​are equal, then there is a mapping relationship between the two, which is reflected in the probability attack graph as an extended directed edge pointing to the attack node. In addition, due to the change of network topology, the node reachability probability also needs to be reconstructed and probabilistic reasoning is performed: before and after the alarm a i The reachability probabilities are P(a i ) and P(a i |o i), the former is called the prior node reachability probability, and the latter is the posterior node reachability probability. According to the total probability and Bayesian formula, the posterior reachability probability is:

[0127]

[0128] where d i 、u i Respectively represent the detection rate and false alarm rate of the corresponding IDS, the detection rate d i Indicates the probability of IDS correctly alerting when facing an intrusion attack, and the false alarm rate u i The probability that an IDS will mistakenly report normal behavior as an attack. This depends on the host and the type of IDS. The calculation method is as follows:

[0129] Table 3 IDS detection matrix

[0130] Detected as intrusion Detected as non-invasive Actually an invasion TA FNA Practically non-invasive FA TNA

[0131]

[0132] For the obtained posterior node reachability probability P(a i |o i ), if it is less than 50%, it means the corresponding If the posterior probability is greater than 50%, it is equivalent to detecting normal behavior as an attack, resulting in a false alarm. If the posterior probability is less than the prior probability, it indicates that the alarm information is inconsistent with the original attack, resulting in a false alarm. In other words, the corresponding alarm is only true when the posterior probability is greater than 50% and greater than the prior probability; otherwise, it is a false alarm. After obtaining the posterior node reachability probability, the reachability probabilities of all subsequent child nodes are adjusted as the associated relationships are transferred. In layman's terms, the above process can be summarized as follows: after the IDS detects an attack, the probability of the attack increases significantly. Since the attack target has not yet been reached, the attack will not stop, and the reachability probabilities of subsequent nodes associated with the attack will also increase.

[0133] Initial time t (0) No alarm occurs, and the resulting probability attack graph is denoted as Att_G (0) , if the alarm sequence detected by IDS over time is O={o i (1) ,o j (2) ,...,o n (t)}, based on the above method, the probability attack graph set ATTS = {Att_G (1) ,Att_G (2) ,...,Att_G (t)}.

[0134] Step 5: Dynamic attack path identification

[0135] Using the attack graph generation method introduced in step 4, at the initial time t (0) When there is no alarm, a probabilistic attack graph is generated and the reachability probability of each prior and a posteriori node is calculated. At this time, since there is no alarm information, the reachability probability of the prior and a posteriori nodes is equal. The target attribute node with the highest probability is compared with the target attribute node with the highest probability. Starting from the maximum attack intention, the reverse depth search algorithm is used to search for the node with the highest probability of the posterior node in the parent node, and add it to the attack path until the initial attribute node is formed. (0) The maximum probability attack path Path_0 at the next moment t (1) , generate alarm information o i (1) , update the posterior node reachability probability and maximum attack intention of each node, and use the updated maximum attack intention as the starting point to reversely search for the node with the highest probability of reaching the alarm node or posterior node in the parent node, and add it to the attack path to form Path_1. Similarly, t (2) -t (t) Repeat the above process at all times and finally output t (t) The maximum attack intention at the moment and the attack path with the maximum probability Path_t.

[0136] In the embodiment, the above dynamic attack path identification method is used to identify the alarm sequence O={o i (1) ,o j (2) ,o n (3) ,o f (4) The maximum attack intention and attack path change over time as shown in the following figure: Figure 7 As shown in the figure, the maximum attack intention inferred by the final comprehensive posterior knowledge estimation is s9, the reachable probability of s9 is 46.07%, and the maximum probability attack path is successfully identified.

[0137] In summary, the proposed method for identifying industrial control system attack paths based on alarm sequence probability leverages the topological relationships between hosts in an industrial control system to identify existing vulnerabilities. This method then quantifies the state transitions of nodes within the topology at a vulnerability level. Alarm information generated by an intrusion detection system is incorporated and mapped to corresponding nodes, thereby better aligning with real-world attacks. Finally, dynamic a posteriori estimation of attack intent and reverse search of attack paths are performed on the resulting probabilistic attack graph, enabling dynamic risk assessment of potential attack paths within the industrial control system.

[0138] The above description of the method principles of the present invention is based on ideal embodiments. The present invention is not limited to the above embodiments. Based on the above description, those skilled in the art can make various changes and modifications without departing from the technical scope of the present invention. The technical scope of the present invention is not limited to the contents of the specification and must be determined according to the scope of the claims.

Claims

1. A method for identifying attack paths of industrial control systems based on alarm sequence probability, characterized in that: Here are the steps: Step 1: Reachability analysis; Conduct reachability analysis on the logical and physical dependencies between host nodes in the industrial control system network, and collect industrial control system accessibility information, system vulnerability information, and intrusion detection system data; Step 2: Modeling the basic elements of the attack; Define an attribute attack graph, which is obtained by correlating the industrial control system accessibility information and system vulnerability information collected in step 1 of the reachability analysis. This graph is used to show the attacker's goals and potential complete attack paths. Step 3: Calculate the node transfer probability and node reachability probability; Step 4: Generate a probabilistic attack graph based on the alarm information; Based on the definition of the attack elements of the attribute attack graph in step 2 and the node transfer probability in step 3, a probabilistic attack graph is generated based on the attribute attack graph based on the idea of ​​graph traversal. The probabilistic attack graph is equivalent to exhaustively enumerating the child nodes and matching the parent nodes of each attribute node and attack node based on the industrial system access information until all nodes are traversed. At the same time, the alarm information generated by the IDS deployed at each layer of the industrial control system network is used to indicate the attack behavior information occurring on the host. The probability of a valid alarm information corresponds to an atomic attack. Based on the above-generated probabilistic attack graph, a mapping between alarm nodes and atomic attack nodes is established to reconstruct the probabilistic attack graph and ultimately identify the maximum probability attack path. Step 5: Dynamic attack path identification; Using the probabilistic attack graph generation method introduced in step 4, at the initial moment When there is no alarm, a probabilistic attack graph is generated, and the reachability probability of each prior node and the reachability probability of each a posteriori node are calculated; Compare the reachability probabilities of each target attribute posterior node, and the target attribute node with the largest probability is the one with the greatest attack intention; Starting from the maximum attack intention, the reverse depth search algorithm is used to search for the node with the highest probability of being reached by the posterior node in the parent node, and add it to the attack path until the initial attribute node is added to the attack path to form a Maximum probability attack path at any moment ; The next moment , generate alarm information , update the posterior node reachability probability and maximum attack intention of each node, and use the updated maximum attack intention as the starting point to reversely search the alarm node or the node with the largest posterior node reachability probability in the parent node, and add it to the attack path at the current moment to form Maximum probability attack path at any moment ; and so on, - Repeat the above process at all times and finally output Maximum attack intention and maximum probability attack path at any moment ; The priori node reachability probability refers to the node reachability probability when the attack node does not have an alarm node mapped to it; the a posteriori node reachability probability refers to the node reachability probability when the attack node has an alarm node mapped to it.

2. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 1 is characterized in that: The attribute attack graph contains two basic elements: nodes and directed edges. The nodes represent the status information of the industrial control system, including host attributes, atomic attacks, and alarm information, which correspond to attribute nodes respectively. , attack node , alarm node The directed edge represents the utilization relationship between nodes, that is, the state migration from one node to another. According to the different types of nodes connected by the directed edge, the directed edge is divided into attribute nodes. To the attack node The prerequisite is that there is a directed edge and attack nodes To attribute node The result of the post-directed edge Two major categories.

3. The industrial control system attack path identification method based on alarm sequence probability according to claim 2 is characterized in that: The attribute attack graph is defined as a binary ,in represents the attack graph, is a node set, is a directed edge set; Node Set Defined as a triple , It is a set of attribute nodes, which indicates the permissions that can be obtained before and after the attack. , target node set , process node set constitute: , the basic form is: ； in, Represents an attribute node serial number, express IP address, express permissions possessed or acquired; is an atomic attack set. In the attribute attack graph, an atomic attack refers to an indivisible attack action performed by an attacker using a vulnerability. This attack action is not affected by the relationship between nodes. The basic form is: ； in Indicates the attack node serial number, express IP address, express The vulnerability number of the attack, Indicates the level of the vulnerability disclosed, which is divided into high level H, medium level M, and low level L; For an alarm sequence, for a certain attack , if exists ,Right now Can be mapped to attack If the ; The basic form of the alarm sequence is: ； in Indicates an alarm occurs time, express Number, express IP address, Indicates that an alarm message is generated The type of IDS; Directed edge set Defined as a binary , For the prerequisite directed edge set, from the attribute node Connect to attack node , indicating that the attacker must have the permissions on the attribute node, which is a prerequisite for carrying out this atomic attack; the basic form is: ； in Represented by attribute nodes Pointing to the attack node The directed edge of 、 Respectively Number and IP address, 、 Respectively Number and IP address, Indicates attachment to The weight between the two, its physical meaning is the attribute node Attack Node The probability of successful transfer between is the set of directed edges of the post-result, consisting of the attacking nodes Link to attribute node , which means that the attacker obtains the subsequent attribute node permissions after executing an atomic attack; ； in Indicates that the attack node Point to attribute node The directed edge of 、 Respectively Number and IP address, 、 Respectively Number and IP address, Indicates the attack node To attribute node The probability of successful transfer.

4. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 1, characterized in that: The node transfer probability refers to the probability of state migration of nodes at both ends of the directed edge of the attribute attack graph along the directed edge; the node transfer probability is a real number in the range of 0-1 attached to the directed edge. Including the node transfer probability attached to the premise condition directed edge and the node transfer probability attached to the post-result directed edge; Property Node To the attack node The node transfer is regarded as the use of attribute nodes The node transfer probability is equivalent to the attack occurrence probability, that is, the attack occurrence probability is mapped to the premise condition directed edge The attack probability is calculated as follows: the atomic attack probability output by the basic metric group of the common vulnerability scoring system that introduces the host impact factor is multiplied by the time impact factor output by the vulnerability lifecycle model; Attack Node To attribute node The node transfer is regarded as a successful atomic attack on the host and the host attributes are obtained. At this time, the node transfer probability is equivalent to the attack success probability, that is, the attack success probability is mapped to the post-result directed edge Based on the node transfer probability, the attack success probability is calculated according to the vulnerability classification.

5. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 4 is characterized in that: The basic metric group of the universal vulnerability scoring system that introduces the host impact factor is , is the atomic attack probability, the subscript represents the vulnerabilities; The host impact factor varies depending on the host type. The difficulty of vulnerability attacks is ranked from difficult to easy as follows: database, server, PC, PLC. The corresponding host impact factors are set to 0.625, 0.750, 0.875, and 1.

000. It is an attack path in the Common Vulnerability Scoring System basic metric group, which describes the attack methods taken by the attacker, including local attack, adjacent network attack, and network attack. CVSS stipulates The corresponding values ​​are 0.395, 0.646, and 1.000; The attack complexity in the Common Vulnerability Scoring System basic metric group describes the complexity of the attacker's attack on the vulnerability, including high complexity, medium complexity, and low complexity. The corresponding values ​​are 0.350, 0.610, and 0.710; It is the identity authentication in the basic metric group of the Common Vulnerability Scoring System, which describes whether the attacker needs to pass the identity authentication or the number of authentications when attacking, including multi-factor authentication, single-factor authentication, and no authentication required. The corresponding values ​​are 0.450, 0.560, and 0.704 respectively.

6. The method for identifying industrial control system attack paths based on alarm sequence probability according to claim 4 is characterized in that: The vulnerability life cycle model is expressed as: ； Based on the system vulnerability information obtained from the reachability analysis, record the dates of the latest and oldest vulnerabilities in the industrial control system in days, and record the date difference as the time span of the system vulnerability. , collection time span All vulnerability information collected by NVD, including vulnerability classification information as L, M, H, and information on status changes over the years; calculate vulnerability information for different vulnerability levels in : ； ； ； ； ； After obtaining the parameters of the vulnerability lifecycle management model, time reasoning is performed in days. At the initial moment , state probability distribution vector ,go through Queen of Heaven, ,in Indicates passing The Queen vulnerability is located in That is, the probability of exploitation; define the time impact factor, for the vulnerability on the host , The time impact factor of the Queen ,in Indicates vulnerability level.

7. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 1, characterized in that: The node reachability probability is a measure of the overall probability of an attacker successfully reaching the node. Attribute attack graph association structure reasoning is performed, and the connection relationship is divided into sequential, conjunction, and disjunction relationships according to the different parent-child node connections. The node reachability probability is calculated using a top-down recursive method, and the child node reachability probability is calculated based on the parent node reachability probability, the parent-child node transfer probability, and the parent-child node association relationship. Based on the node definition and the association relationship between nodes derived by reasoning, a directed link is defined from the initial node via the transition node to the target node; the directed link is composed of the above nodes and the directed edges associated therebetween, and the directed link is regarded as an attack path.

8. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 7 is characterized in that: The relationship between the posterior node reachability probability and the prior node reachability probability is: ； in, represents the prior probability of reachability, represents the posterior reachability probability, Indicates the detection rate of the IDS corresponding to the alarm node, Indicates the false alarm rate of the IDS corresponding to the alarm node.

9. The method for identifying attack paths of industrial control systems based on alarm sequence probability according to claim 1, characterized in that: The industrial control system accessible information specifically includes the detailed configuration of each host, the type of service running, the trust relationship between hosts, and the network topology; the intrusion detection system data specifically includes IDS performance data, firewall access control and filtering rules; the system vulnerability information specifically includes the vulnerability information existing on each host of the industrial control system.

Images