Industrial control software security test platform based on virtuality and reality combination

Abstract

The invention discloses an industrial control software security test platform based on virtuality and reality combination, which relates to the technical field of industrial control system security test, and comprises a test monitoring sub-platform used for centrally controlling the operation of a simulation environment and a test tool, visually outputting a test environment, a tested object and a threat behavior, and storing the test environment, the tested object and the threat behavior; recording and analyzing the test data to quantitatively evaluate the safety risk; the safety test tool set is used for monitoring state parameters of the industrial control system, detecting abnormal behaviors of the industrial control system and executing a threat injection test; the security information library is used for storing a defect information library, a software and hardware vulnerability library, a network protocol feature library and a test case library of the industrial control system; and the simulation operation environment is used for building a complete operation environment of the industrial control system through a simulation means. The method supports the interaction test of the physical equipment and the virtual MES, can simulate the real industrial network environment such as bandwidth limitation and packet loss rate, and improves the credibility of the test result.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control system security testing, and more particularly to an industrial control software security testing platform based on a combination of virtual and real. Background Art

[0002] Currently, industrial control systems (ICS), as the core carrier of critical infrastructure, have software security that directly impacts industrial production stability and national economic security. Traditional ICS security testing technologies primarily rely on script-driven automated tools and offline simulation environments, achieving fundamental capabilities in terms of protocol compatibility, testing efficiency, and scenario realism. However, with the widespread integration of multi-source, heterogeneous devices in the Industrial Internet and the continuous evolution of new attack techniques, existing testing platforms have exposed significant limitations. First, due to insufficient reverse engineering capabilities for proprietary protocols, they struggle to cover industrial control protocols from multiple vendors, limiting the coverage of multi-device collaborative testing. Second, traditional fuzz testing tools lack the integration of protocol state machine modeling and semantic constraint rules, resulting in inaccurate malformed packet attacks. Furthermore, the lack of a dynamic seed optimization mechanism reduces vulnerability discovery effectiveness. Third, data exchange barriers exist between physical testing environments and virtual simulation systems, making some test cases unable to realistically simulate the real-time response characteristics of industrial field devices and controllers. Therefore, overcoming these shortcomings is an urgent challenge for those skilled in the art. Summary of the Invention

[0003] In view of this, the present invention provides an industrial control software security testing platform based on the combination of virtual and real, which overcomes the above-mentioned defects.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] A virtual-real combination industrial control software security testing platform, including:

[0006] The test monitoring sub-platform, including a main operation console and multiple auxiliary operation consoles, is used to centrally control the simulation environment and test tool operations, visualize the test environment, tested objects, and threat behaviors, and record and analyze test data to quantitatively assess security risks.

[0007] A security testing toolset for monitoring status parameters of industrial control systems and detecting abnormal behaviors of said industrial control systems, and performing threat injection testing;

[0008] A security information library, used to store the defect information library, software and hardware vulnerability library, network protocol feature library and test case library of the industrial control system;

[0009] A simulation operating environment, including virtual devices, virtual subsystems, and virtual MES, is used to build a complete operating environment for the industrial control system through simulation;

[0010] The running scenario library is used to construct a test scenario based on the virtual device, the virtual subsystem and the virtual MES according to preset standards.

[0011] In one embodiment, the security testing toolset further includes a threat access sub-platform for providing an entry point for external threat sources acting on the industrial control system.

[0012] In one embodiment, an emulation access sub-platform is further included, configured to provide a hard-wired port and a communication interface for connecting to the industrial control system.

[0013] In one embodiment, the threat injection test includes port scanning / operating system detection test, fuzzing test, authentication attack test, logic attack test, command execution test, authorization attack test and client attack test.

[0014] In one embodiment, the specific steps of the fuzzing test are:

[0015] Obtaining network data of a target device, and preprocessing the network data to generate a set of data packets to be analyzed;

[0016] Adding the first message in the set of data packets to be analyzed to a typical message list, and merging the other messages into a list of messages to be processed, traversing the list of messages to be processed, and calculating the distance data between the current message to be processed and all typical messages in the typical message list, and screening out typical data packets based on the distance data;

[0017] Constructing an initial typical message list based on the typical data packets, and deleting the initial typical message list based on a preset list length threshold to obtain a typical message list;

[0018] Constructing a seed list based on each typical message in the typical message list and the corresponding sent message, a similar message with the largest distance data from the typical message in the similarity list of each typical message, and the sent message corresponding to the similar message;

[0019] performing mutation processing on the sent messages in the seed list to generate multiple deformed data packets;

[0020] A plurality of the deformed data packets are used to perform remote fuzz testing on the target device to identify security flaws in the industrial control system.

[0021] In one embodiment, the steps of obtaining the typical data packet are:

[0022] Step 21: Add the first message in the set of data packets to be analyzed to the typical message list, and merge the other messages into the list of messages to be processed;

[0023] Step 22: Select any message to be processed in the list of messages to be processed, calculate the distance data between the message to be processed and each typical message in the list of typical messages, convert the distance data into similarity values, and extract the maximum similarity value;

[0024] Step 23: Determine whether the maximum similarity value is less than a preset similarity threshold. If so, merge the message to be processed into the typical message list and initialize its similarity list; if not, add the message to be processed to the similarity list of the typical message corresponding to the maximum similarity value;

[0025] Step 24: Repeat steps 22 to 24 until the processed message list is empty.

[0026] In one embodiment, the mutation processing includes: bit flipping, arithmetic operation and content replacement.

[0027] In one embodiment, the specific steps of the remote fuzz testing are:

[0028] Sending the malformed data packet to the target device, and if no response packet is received, sending a probe packet;

[0029] If there is no response to the detection, it is determined that the target device has crashed, and vulnerability verification is performed based on the malformed data packet.

[0030] Through the above technical solutions, it can be seen that the present invention discloses a virtual and real-based industrial control software security testing platform, which has the following beneficial effects compared with the existing technology:

[0031] 1. Adopt a one-click automated testing process, reduce manual intervention by 80%, significantly shorten the vulnerability discovery cycle, and is suitable for large-scale industrial network detection.

[0032] 2. Supports interactive testing of physical devices and virtual MES (Manufacturing Execution System), simulating real industrial network environments such as bandwidth limitations and packet loss rates to improve the credibility of test results.

[0033] 3. It adopts a modular design, supports dynamic expansion of test nodes, adapts to the needs of multi-device parallel testing in complex industrial environments, and meets the vulnerability mining tasks of large industrial control networks.

[0034] 4. Optimize the typical message list through the edit distance algorithm to ensure that the mutation seeds cover key protocol fields, improve the targeting of malformed data packets, and reduce the number of invalid tests.

[0035] 5. Combined with active detection mechanism (ICMP / TCP SYN), it accurately identifies abnormal device status and avoids test interruption caused by misjudgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0037] Figure 1 A schematic diagram of the system structure provided by the present invention;

[0038] Figure 2 A schematic diagram of the process of performing Fuzz testing on a target device based on the industrial control vulnerability mining method provided by the present invention;

[0039] Figure 3 A schematic diagram of the process of fuzz testing PLC based on ModBus message similarity comparison provided by the present invention. DETAILED DESCRIPTION

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0041] The embodiment of the present invention discloses an industrial control software security testing platform based on virtual and real integration, such as Figure 1 ,include:

[0042] The test monitoring sub-platform, including a main operation console and multiple auxiliary operation consoles, is used to centrally control the simulation environment and test tool operations, visualize the test environment, tested objects, and threat behaviors, and record and analyze test data to quantitatively assess security risks.

[0043] A security testing toolset for monitoring the status parameters of industrial control systems, detecting abnormal behavior of industrial control systems, and performing threat injection testing;

[0044] Security information library, used to store industrial control system defect information library, software and hardware vulnerability library, network protocol feature library and test case library;

[0045] The simulation operating environment, including virtual devices, virtual subsystems and virtual MES, is used to build a complete operating environment for industrial control systems through simulation;

[0046] The runtime scenario library is used to build test scenarios based on virtual devices, virtual subsystems, and virtual MES according to preset standards.

[0047] In one embodiment, the security testing toolset further includes a threat access sub-platform for providing an entry point for external threat sources acting on the industrial control system.

[0048] In one embodiment, an emulation access sub-platform is further included, configured to provide a hard-wired port and a communication interface for connecting to an industrial control system.

[0049] Furthermore, the test monitoring sub-platform mainly provides a centralized operation console for security testing, including a main operation console and several auxiliary operation consoles, which jointly complete the operation control of the simulation environment and test tools; provide comprehensive visual output of the test environment, the object under test, and the threat behavior through a large-screen display; provide recording and analysis of test data, identify the weak links of the object under test, and make quantitative assessments of the information security risks of the industrial control system under test.

[0050] The security testing toolset is mainly used to monitor the status parameters of industrial control systems, including asset operation status security monitoring and asset configuration monitoring; detect abnormal behaviors of industrial control systems and conduct real-time analysis, including abnormal communication detection, illegal access detection, and malicious attack behavior alarms; inject threat detection signals into industrial control systems and conduct real-time detection and analysis, including port scanning / operating system detection, fuzzing testing, authentication attacks, logical attacks, command execution, authorization attacks, client attacks, etc.

[0051] The threat access sub-platform mainly provides an entry point for external threat sources that the industrial control system may be exposed to during configuration and operation, such as the enterprise management information area interface, subsystem interconnection interface, remote maintenance interface at the boundary of the industrial control system, and redundant interfaces of switches within the industrial control system, as well as redundant communication interfaces of hosts, controllers or engineer stations.

[0052] The security information database mainly includes: a defect information database of typical industrial control systems; a vulnerability database of operating systems, databases, and industrial control systems; a feature database of industrial control network communication protocols; and a test case database of typical industrial control systems.

[0053] The simulation runtime environment primarily uses simulation to build a complete operating environment for industrial control systems, including virtual devices that mimic the underlying process systems, virtual subsystems that mimic the interconnection with the industrial control system, and a virtual MES that mimics interaction with the Level 3 Manufacturing Execution System (MES). The virtual devices provide high-precision I / O capabilities, enabling direct connection to the industrial control system's I / O units and being driven and managed using common configurable test tools. The virtual subsystems and virtual MES are simulated purely using software.

[0054] The simulation access sub-platform mainly provides hard-wired ports that can be directly connected to the industrial control system and communication interfaces between the upper and lower layers of the control system.

[0055] Running scenario library, main functions: virtual devices, virtual subsystems, virtual MES adopt the software structure and interface form specified by IS020242 (test application service interface), maintain high flexibility and scalability, and construct a sufficiently real, complex and diverse industry application environment for security testing.

[0056] In one embodiment, the threat injection test includes port scanning / operating system detection test, fuzzing test, authentication attack test, logic attack test, command execution test, authorization attack test and client attack test.

[0057] In one embodiment, the specific steps of the fuzzing test are:

[0058] Step 1: Obtain network data from the target device and pre-process the network data to generate a set of data packets to be analyzed;

[0059] Step 2: Add the first message in the set of data packets to be analyzed to the typical message list, and merge the other messages into the list of messages to be processed. Traverse the list of messages to be processed and calculate the distance data between the current message to be processed and all typical messages in the typical message list, and filter out typical data packets based on the distance data;

[0060] Step 3: construct an initial typical message list based on the typical data packets, and delete the initial typical message list based on a preset list length threshold to obtain a typical message list;

[0061] Step 4: construct a seed list based on each typical message in the typical message list and the corresponding sent message, the similar message with the largest distance data from the typical message in the similarity list of each typical message, and the sent message corresponding to the similar message;

[0062] Step 5: Perform mutation processing on the sent messages in the seed list to generate multiple deformed data packets;

[0063] Step 6: Use multiple malformed data packets to perform remote fuzz testing on the target device to identify security vulnerabilities in the industrial control system.

[0064] In one embodiment, the steps for obtaining a typical data packet are:

[0065] Step 21: Add the first message in the set of data packets to be analyzed to the typical message list, and merge the other messages into the list of messages to be processed;

[0066] Step 22: Select any message to be processed in the list of messages to be processed, calculate the distance data between the message to be processed and each typical message in the list of typical messages, convert the distance data into similarity values, and extract the maximum similarity value;

[0067] Step 23: determine whether the maximum similarity value is less than a preset similarity threshold. If so, merge the message to be processed into the typical message list and initialize its similarity list; if not, add the message to be processed to the similarity list of the typical message corresponding to the maximum similarity value;

[0068] Step 24: Repeat steps 22 to 24 until the processed message list is empty.

[0069] In one embodiment, the mutation processing includes bit flipping, arithmetic operation, and content replacement.

[0070] In one embodiment, the specific steps of remote fuzz testing are:

[0071] Send a malformed data packet to the target device. If no response packet is received, send a probe packet.

[0072] If there is no response to the probe, the target device is determined to have crashed, and vulnerability verification is performed based on the malformed data packet.

[0073] Furthermore, we take the industrial control vulnerability mining method to perform Fuzz testing on the target device as an example to describe the specific steps. Figure 2 As shown:

[0074] Step 1: Get the data packet set to be analyzed, specifically:

[0075] Use network monitoring and analysis tools such as Wireshark, Tcpdump, Burpsuite, Fiddler, Scapy, or libpcap to capture data packets targeting specific target devices to build a data packet set for analysis. These target devices may include, but are not limited to, network cameras, smart routers, smart light bulbs, and PLCs. Target protocols of interest include TCP, UDP, FTP, Telnet, HTTP, RTSP, S7, and MODBUS.

[0076] Step 2: Get a list of typical packets based on the set of packets to be analyzed, specifically:

[0077] Representative packets are selected from the set of packets to be analyzed. The selection criteria are further refined by calculating similarities between packets (using methods such as Minkowski distance, Hamming distance, and edit distance). Based on the similarity calculation results, typical packets are identified and a list of similar packets is associated with each typical packet. Finally, a typical packet list containing at least one typical packet is constructed.

[0078] Step 3: Select high-quality seeds for mutation, specifically:

[0079] Select appropriate seed data packets from the typical message list constructed in step 2 as the basis for subsequent mutations. The steps to obtain them are:

[0080] First, determine whether the length of the similar message list of each typical message in the typical message list is greater than the preset threshold. If so, add the sent message corresponding to the current typical message to the seed list, and then add the sent message corresponding to the message with the largest distance from the current typical message in the similar message list to the seed list; repeat the above operation and traverse the typical message list to the end.

[0081] Step 4: Generate a malformed data packet, specifically:

[0082] Based on the selected seed, a malformed data packet is generated through mutation operation.

[0083] Step 5: Perform remote fuzz testing, specifically:

[0084] The generated malformed data packets are sent to the target device to perform the remote fuzzing process.

[0085] Step 6: Discover security flaws, specifically:

[0086] Through remote fuzz testing, security vulnerabilities in the Internet of Things and industrial control systems can be effectively detected, and the effectiveness of vulnerability mining in industrial control system equipment can be improved.

[0087] Furthermore, the PLC is fuzz tested based on the ModBus message similarity comparison in the industrial control vulnerability mining method. The specific steps are as follows: Figure 3 As shown:

[0088] Step 1: Send data packets and capture, specifically:

[0089] First, the host computer software sends control instructions to the ModBus protocol slave computer. These operations include, but are not limited to, reading and writing coil status and register values. At the same time, the Wireshark tool is used to capture data packets transmitted on the network in preparation for subsequent analysis.

[0090] Step 2: Data packet preprocessing, specifically:

[0091] Apply the "modbus" filter to all packets captured by Wireshark to filter out only packets involving the ModBus protocol. Furthermore, perform deduplication on the filtered packets to form a set of packets to be analyzed.

[0092] Step 3: Protocol data packet analysis and typical message list construction, specifically:

[0093] The first packet from the set of packets to be analyzed is selected and added to the typical packet list. Next, the remaining reply packets are traversed, and the edit distance between each packet and all packets in the typical packet list is calculated. Based on whether the edit distance exceeds a set threshold, a decision is made as to whether the current packet is added to the typical packet list, making it a typical packet and initializing its similarity list to empty (if it exceeds the threshold), or whether it is placed in the similarity list of the most similar typical packet (if it does not exceed the threshold).

[0094] Step 4: Get the seed list based on the typical message list, specifically:

[0095] Each message in the typical message list is evaluated along with the number of similar messages. If the number of similar messages for a typical message falls below a preset threshold, it is removed from the list. A seed list is then constructed based on the remaining typical messages. Specifically, the current message and the message in its similar message list with the least similarity to it are added to the seed list.

[0096] Step 5: Get the malformed data packet based on the seed list, specifically:

[0097] For each message in the seed list, the corresponding sent message is found and mutated. Mutation methods can include bit flipping, performing integer addition and subtraction arithmetic operations, or replacing special content to obtain malformed data packets.

[0098] Step 6: Perform vulnerability mining on the target device based on the malformed data packet, specifically:

[0099] Potential vulnerabilities are detected by sending malformed packets to the target device and monitoring the response. If no response is received, a probe packet (such as ICMP or TCP SYN) is sent to check the target device's status. If the target device does not respond, it may be considered to have crashed. At this point, a proof-of-concept script is written based on the malformed packet that caused the crash to verify the existence of the vulnerability.

[0100] Step 7, loop and end conditions, specifically:

[0101] Each message in the seed list is mutated and tested in turn according to the predetermined number of mutations. Once all seeds have completed the specified number of mutations, the entire process ends.

[0102] In one embodiment, the following description is made using the security assessment of a factory's industrial control system as an application scenario:

[0103] 1. Construction of virtual and real environment:

[0104] Simulate factory DCS networks through a drag-and-drop topology builder, integrating real PLCs (Siemens S7-1500) with virtual MES systems;

[0105] Configure the link packet loss rate (5%) to simulate industrial field network fluctuations;

[0106] Use the drag-and-drop topology builder to design industrial control network architectures including firewalls and switches.

[0107] 2. Vulnerability detection process:

[0108] Parse S7 protocol communication data blocks and extract read and write instruction semantic rules;

[0109] Capture S7 protocol traffic, calculate message similarity, and select 10 typical data packets (similarity threshold > 75%).

[0110] Generate a seed list and perform mutations according to the protocol field rules (such as tampering with data block addresses and injecting abnormal function codes);

[0111] After sending the malformed data packet, the PLC status is confirmed through TCP half-connection detection.

[0112] 3. Result output:

[0113] An unauthorized data block write vulnerability (CVE-2023-XXXX) was discovered in the PLC, with a CVSS score of 9.0.

[0114] The platform automatically generates a repair report, recommending enabling encrypted communication and restricting the execution of illegal instructions.

[0115] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0116] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A virtual-real combination industrial control software security testing platform, characterized by: include: The test monitoring sub-platform, including a main operation console and multiple auxiliary operation consoles, is used to centrally control the simulation environment and test tool operations, visualize the test environment, tested objects, and threat behaviors, and record and analyze test data to quantitatively assess security risks. A security testing toolset for monitoring status parameters of industrial control systems and detecting abnormal behaviors of said industrial control systems, and performing threat injection testing; A security information library, used to store the defect information library, software and hardware vulnerability library, network protocol feature library and test case library of the industrial control system; A simulation operating environment, including virtual devices, virtual subsystems, and virtual MES, is used to build a complete operating environment for the industrial control system through simulation; The running scenario library is used to construct a test scenario based on the virtual device, the virtual subsystem and the virtual MES according to preset standards.

2. The industrial control software security testing platform based on virtual and real integration according to claim 1 is characterized in that: The security testing toolset also includes a threat access sub-platform for providing an entry for external threat sources acting on the industrial control system.

3. The industrial control software security testing platform based on virtual and real integration according to claim 1 is characterized in that: It also includes a simulation access sub-platform for providing a hard-wired port and a communication interface to connect to the industrial control system.

4. The industrial control software security testing platform based on virtual and real integration according to claim 1 is characterized in that: Threat injection testing includes port scanning / operating system detection testing, fuzzing testing, authentication attack testing, logical attack testing, command execution testing, authorization attack testing and client attack testing.

5. The industrial control software security testing platform based on virtual and real integration according to claim 4 is characterized in that: The specific steps of the Fuzzing test are: Obtaining network data of a target device, and preprocessing the network data to generate a set of data packets to be analyzed; Adding the first message in the set of data packets to be analyzed to a typical message list, and merging the other messages into a list of messages to be processed, traversing the list of messages to be processed, and calculating the distance data between the current message to be processed and all typical messages in the typical message list, and screening out typical data packets based on the distance data; Constructing an initial typical message list based on the typical data packets, and deleting the initial typical message list based on a preset list length threshold to obtain a typical message list; Constructing a seed list based on each typical message in the typical message list and the corresponding sent message, a similar message with the largest distance data from the typical message in the similarity list of each typical message, and the sent message corresponding to the similar message; performing mutation processing on the sent messages in the seed list to generate multiple deformed data packets; A plurality of the deformed data packets are used to perform remote fuzz testing on the target device to identify security flaws in the industrial control system.

6. The industrial control software security testing platform based on virtual and real integration according to claim 5 is characterized in that: The steps for obtaining the typical data packet are: Step 21: Add the first message in the set of data packets to be analyzed to the typical message list, and merge the other messages into the list of messages to be processed; Step 22: Select any message to be processed in the list of messages to be processed, calculate the distance data between the message to be processed and each typical message in the list of typical messages, convert the distance data into similarity values, and extract the maximum similarity value; Step 23: determine whether the maximum similarity value is less than a preset similarity threshold; if so, merge the to-be-processed message into the typical message list and initialize its similarity list; If not, adding the message to be processed to the similarity list of the typical message corresponding to the maximum similarity value; Step 24: Repeat steps 22 to 24 until the processed message list is empty.

7. The industrial control software security testing platform based on virtual and real integration according to claim 5 is characterized in that: The mutation processing methods include: bit flipping, arithmetic operation and content replacement.

8. The industrial control software security testing platform based on virtual and real integration according to claim 5 is characterized in that: The specific steps of the remote fuzz testing are: Sending the malformed data packet to the target device, and if no response packet is received, sending a probe packet; If there is no response to the detection, it is determined that the target device has crashed, and vulnerability verification is performed based on the malformed data packet.

Images