A virtual-real combined industrial control software security test platform

Abstract

The application discloses a kind of industrial control software security test platform based on virtual and real combination, it is related to industrial control system safety testing technical field, including: test monitoring sub-platform, for centralized control simulation environment and test tool operation, to test environment, measured object and threat behavior are visualized output, and record, analyze test data to quantize evaluation security risk;Security test tool set, for monitoring the state parameters of industrial control system and detecting the abnormal behavior of industrial control system, and performing threat injection test;Security information base, for storing the defect information base of industrial control system, hardware and software vulnerability library, network protocol feature library and test case library;Simulation running environment, for building the complete running environment of industrial control system through simulation means.The application supports the interactive test of physical equipment and virtual MES, can simulate bandwidth limit, packet loss rate and other real industrial network environment, improve the credibility of test result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control system security testing, and more particularly to an industrial control software security testing platform based on virtual-real combination. BACKGROUND

[0002] At present, as the core carrier of key infrastructure, the software security of industrial control system (ICS) directly affects the stability of industrial production and the safety of national economy. The traditional industrial control security testing technology mainly relies on the automation tools driven by manual scripts and the offline simulation environment, and has formed a basic ability in protocol compatibility, testing efficiency and scene authenticity. However, with the wide access of multi-source heterogeneous devices under the industrial internet environment and the continuous evolution of new attack technologies, the existing testing platform exposes significant limitations: firstly, due to the insufficient reverse analysis ability of private protocols, it is difficult to cover the types of industrial control protocols of multiple manufacturers, resulting in limited multi-device collaborative testing coverage; secondly, the traditional fuzzy testing tool does not combine the protocol state machine modeling and semantic constraint rules, the generated abnormal data packet attack precision is insufficient, and the lack of dynamic seed optimization mechanism leads to low effectiveness of vulnerability mining; thirdly, there is a data interaction barrier between the physical testing environment and the virtual simulation system, and some test cases cannot simulate the real-time response characteristics between industrial field devices and controllers. Therefore, how to overcome the above defects is a problem that the technical personnel in the field need to solve. SUMMARY

[0003] Therefore, the present application provides an industrial control software security testing platform based on virtual-real combination, which overcomes the above defects.

[0004] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0005] An industrial control software security testing platform based on virtual-real combination comprises:

[0006] A test monitoring sub-platform comprising a main operation console and a plurality of cooperative operation consoles, for centralized control of the running of the simulation environment and the testing tool, visual output of the test environment, the measured object and the threat behavior, and recording and analysis of the test data to quantitatively evaluate the security risk;

[0007] A security testing tool set for monitoring the state parameters of the industrial control system and detecting the abnormal behavior of the industrial control system, and performing threat injection testing;

[0008] A security information library for storing the defect information library, the software and hardware vulnerability library, the network protocol feature library and the test case library of the industrial control system;

[0009] The simulation running environment includes a virtual device, a virtual subsystem and a virtual MES, and is used to build a complete running environment of the industrial control system through simulation means;

[0010] The running scenario library is used to build a test scenario based on the virtual device, the virtual subsystem and the virtual MES according to a preset standard.

[0011] In an embodiment, the security testing tool set further includes a threat access sub-platform, which is used to provide an external threat source entrance acting on the industrial control system.

[0012] In an embodiment, a simulation access sub-platform is further included, which is used to provide a hardwired port and a communication interface to connect the industrial control system.

[0013] In an embodiment, the threat injection test includes a port scanning / operating system detection test, a Fuzzing test, an authentication attack test, a logic attack test, a command execution test, an authorization attack test and a client attack test.

[0014] In an embodiment, the specific steps of the Fuzzing test are as follows:

[0015] Network data of a target device is acquired, and the network data is preprocessed to generate a set of data packets to be analyzed;

[0016] The first message in the set of data packets to be analyzed is added to a typical message list, and other messages are added to a list of messages to be processed. The list of messages to be processed is traversed, and distance data of a current message to be processed and all typical messages in the typical message list are calculated. A typical data packet is selected according to the distance data.

[0017] An initial typical message list is constructed based on the typical data packet, and the initial typical message list is pruned based on a preset list length threshold to obtain a typical message list.

[0018] A seed list is constructed based on each typical message in the typical message list and a corresponding sending message, a most similar message in a similarity list of each typical message and a sending message corresponding to the most similar message.

[0019] The sending messages in the seed list are subjected to mutation processing to generate a plurality of abnormal data packets.

[0020] The plurality of abnormal data packets are used to perform remote fuzzing testing on the target device to identify security defects of the industrial control system.

[0021] In an embodiment, the acquisition step of the typical data packet is as follows:

[0022] Step 21, the first message in the data packet set to be analyzed is added to the typical message list, and other messages are added to the to-be-processed message list;

[0023] Step 22, any to-be-processed message in the to-be-processed message list is selected, the distance data of the to-be-processed message and each typical message in the typical message list is calculated, the distance data is converted into similarity values, and the maximum similarity value is extracted;

[0024] Step 23, it is judged whether the maximum similarity value is less than a preset similarity threshold value, if yes, the to-be-processed message is added to the typical message list, and a similarity list thereof is initialized, and if no, the to-be-processed message is added to the similarity list of the typical message corresponding to the maximum similarity value;

[0025] Step 24, steps 22-24 are repeated until the to-be-processed message list is empty.

[0026] In an embodiment, the mutation processing mode includes bit flipping, arithmetic operation and content replacement.

[0027] In an embodiment, the specific steps of the remote fuzzing test are as follows:

[0028] The malformed data packet is sent to the target device, and if no response packet is received, a probe packet is sent;

[0029] If the probe has no response, it is determined that the target device crashes, and vulnerability verification is performed based on the malformed data packet.

[0030] According to the technical solution, the application discloses a virtual-real combined industrial control software security test platform, which has the following advantages compared with the prior art:

[0031] 1. One-key automatic test process is adopted, manual intervention is reduced by 80%, the vulnerability mining period is greatly shortened, and the test platform is suitable for large-scale industrial network detection.

[0032] 2. The test platform supports the interaction test between physical devices and virtual MES (manufacturing execution system), can simulate real industrial network environments such as bandwidth limitation and packet loss rate, and improves the credibility of test results.

[0033] 3. The test platform adopts modular design, supports dynamic expansion of test nodes, meets the needs of multi-device parallel test in complex industrial environments, and meets the vulnerability mining tasks of large industrial control networks.

[0034] 4. The typical message list is optimized by the edit distance algorithm, the mutation seed covers the key protocol field, the specificity of the malformed data packet is improved, and the number of invalid tests is reduced.

[0035] 5. Combined with the active detection mechanism (ICMP / TCP SYN) to accurately identify the abnormal state of the device, and avoid the test interruption caused by misjudgment. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only a part of the embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.

[0037] Figure 1 The system structure schematic diagram provided by the present application is shown in the figure.

[0038] Figure 2 The process schematic diagram of the Fuzz test of the target device based on the industrial control vulnerability mining method provided by the present application is shown in the figure.

[0039] Figure 3 The process schematic diagram of the Fuzz test of the PLC based on the ModBus message similarity comparison provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0041] The embodiments of the present application disclose an industrial control software security test platform based on virtual-real combination, as shown in Figure 1 , comprising:

[0042] A test monitoring sub-platform, including a main operation console and a plurality of cooperative operation consoles, is used for centralized control of the simulation environment and the test tool running, visual output of the test environment, the measured object and the threat behavior, and recording and analysis of the test data to quantitatively evaluate the security risk;

[0043] A security test tool set is used for monitoring the state parameters of the industrial control system and detecting the abnormal behavior of the industrial control system, and performing threat injection test;

[0044] A security information library is used for storing the defect information library, the software and hardware vulnerability library, the network protocol feature library and the test case library of the industrial control system;

[0045] The simulation running environment includes a virtual device, a virtual subsystem and a virtual MES, and is used to build a complete running environment of the industrial control system through simulation means;

[0046] The running scenario library is used to build a test scenario based on the virtual device, the virtual subsystem and the virtual MES according to a preset standard.

[0047] In an embodiment, the security test tool set further includes a threat access sub-platform, which is used to provide an external threat source entrance acting on the industrial control system.

[0048] In an embodiment, the simulation access sub-platform is further included, which is used to provide a hardwired port and a communication interface to connect the industrial control system.

[0049] Further, the test monitoring sub-platform mainly provides a security test centralized operation console, including a main operation console and a plurality of cooperative operation consoles, which jointly complete operation control of the simulation environment and the test tool; a comprehensive visual output of the test environment, the measured object and the threat behavior is provided through a large screen display; the test data is recorded and analyzed, the weak link of the measured object is identified, and the information security risk of the measured industrial control system is quantitatively evaluated.

[0050] The security test tool set is mainly used to monitor state parameters of the industrial control system, including asset running state safety monitoring and asset configuration monitoring; to detect abnormal behaviors of the industrial control system and perform real-time analysis, including abnormal communication detection, illegal access detection and malicious attack behavior alarm; to inject a threat detection signal into the industrial control system and perform real-time detection and analysis, including port scanning / operating system detection, Fuzzing test, authentication attack, logic attack, command execution, authorization attack and client attack.

[0051] The threat access sub-platform mainly provides external threat source entrances that the industrial control system may be subjected to during configuration and running, such as an enterprise management information interface of a boundary of the industrial control system, a subsystem interconnection interface, a remote maintenance interface, and a redundant interface of a switch inside the industrial control system, a redundant communication interface of a host, a controller or an engineer station.

[0052] The security information library mainly includes: a defect information library of a typical industrial control system; a vulnerability library of an operating system, a database and an industrial control system; an industrial control network communication protocol feature library; and a test case library of a typical industrial control system.

[0053] The simulation running environment mainly builds a complete running environment of the industrial control system through simulation means, including virtual devices simulating the underlying process system, virtual subsystems simulating interconnection with the industrial control system, and virtual MES simulating interaction with the LEVEL 3 manufacturing execution system (MES). Among them, the virtual device provides high-precision I / O capability, can be directly connected with the I / O unit of the industrial control system, and is driven and managed through a general configurable test tool; the virtual subsystem and the virtual MES are simulated by pure software.

[0054] The simulation access sub-platform mainly provides hardwired ports that can be directly connected to the industrial control system and communication interfaces between the upper and lower layers of the control system.

[0055] The running scenario library mainly has the following functions: the virtual device, the virtual subsystem, and the virtual MES adopt the software structure and interface form specified in IS020242 (test application service interface), have high flexibility and expansibility, and construct an industry application environment that is sufficient, real, complex, and diverse for safety testing.

[0056] In an embodiment, the threat injection test includes a port scanning / operating system detection test, a Fuzzing test, an authentication attack test, a logic attack test, a command execution test, an authorization attack test, and a client attack test.

[0057] In an embodiment, the specific steps of the Fuzzing test are as follows:

[0058] Step 1: Obtain the network data of the target device, and pre-process the network data to generate a set of data packets to be analyzed;

[0059] Step 2: Add the first message in the set of data packets to be analyzed to a typical message list, and add other messages to a list of messages to be processed. The list of messages to be processed is traversed, and the distance data of the current message to be processed and all typical messages in the typical message list are calculated. The typical data packets are selected according to the distance data;

[0060] Step 3: Based on the typical data packets, an initial typical message list is constructed, and the initial typical message list is pruned based on a preset list length threshold to obtain the typical message list;

[0061] Step 4: Based on each typical message in the typical message list and the corresponding sending message, the maximum similar message in the similarity list of each typical message, and the sending message corresponding to the similar message, a seed list is constructed;

[0062] Step 5: The sending messages in the seed list are subjected to mutation processing to generate a plurality of abnormal data packets;

[0063] Step 6, remote fuzz testing is performed on the target device using the plurality of malformed data packets to identify security flaws in the industrial control system.

[0064] In an embodiment, the step of obtaining a typical data packet is as follows:

[0065] Step 21, the first message in the set of data packets to be analyzed is added to the list of typical messages, and the other messages are added to the list of messages to be processed.

[0066] Step 22, any message to be processed in the list of messages to be processed is selected, the distance data between the message to be processed and each typical message in the list of typical messages is calculated, the distance data is converted into similarity values, and the maximum similarity value is extracted.

[0067] Step 23, it is determined whether the maximum similarity value is less than a predetermined similarity threshold value. If yes, the message to be processed is added to the list of typical messages, and its similarity list is initialized. If no, the message to be processed is added to the similarity list of the typical message corresponding to the maximum similarity value.

[0068] Step 24, steps 22-24 are repeated until the list of messages to be processed is empty.

[0069] In an embodiment, the mutation processing method includes bit flipping, arithmetic operations, and content replacement.

[0070] In an embodiment, the specific steps of remote fuzz testing are as follows:

[0071] Sending a malformed data packet to the target device, and if no response packet is received, sending a probe packet;

[0072] If the probe has no response, it is determined that the target device has crashed, and vulnerability verification is performed based on the malformed data packet.

[0073] Further, the industrial control vulnerability mining method is described by taking the Fuzz testing of the target device as an example, and the specific steps are as shown in Figure 2

[0074] Step 1, obtaining a set of data packets to be analyzed, specifically:

[0075] ​The network monitoring and analysis tools such as Wireshark, Tcpdump, Burpsuite, Fiddler, Scapy or libpcap are used to capture the data packets for specific target devices to build a set of data packets to be analyzed; these target devices can include but are not limited to network cameras, smart routers, smart bulbs, PLCs and the like. At the same time, the target protocols of interest include Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Telnet protocol, Hypertext Transfer Protocol (HTTP), Real-time Streaming Protocol (RTSP), S7 protocol and MODBUS protocol, etc.

[0076] Step 2, based on the set of data packets to be analyzed to obtain a list of typical messages, specifically:

[0077] The representative messages are selected from the set of data packets to be analyzed, and the similarity between the messages is calculated (the methods used include Minkowski distance, Hamming distance, edit distance, etc.) to further refine the selection criteria. According to the results of the similarity calculation, determine the typical data packets, and associate a list containing similar messages with each typical data packet, i.e. a list of similar messages; finally, a list of typical messages containing at least one typical data packet is constructed.

[0078] Step 3, select high-quality seeds for mutation, specifically:

[0079] Select appropriate seed data packets from the list of typical messages constructed in step 2 as the basis for subsequent mutation, the steps for obtaining them are:

[0080] First, determine whether the length of the list of similar messages for each typical message in the list of typical messages is greater than a predetermined threshold, if so, add the sending message corresponding to the current typical message to the seed list, and then add the sending message corresponding to the message in the list of similar messages that is farthest from the current typical message to the seed list; repeat the above operation to traverse the list of typical messages until the end.

[0081] Step 4, generate abnormal data packets, specifically:

[0082] Based on the selected seeds, generate abnormal data packets through mutation operations.

[0083] Step 5, perform remote fuzz testing, specifically:

[0084] Send the generated abnormal data packets to the target device to perform the remote fuzz testing process.

[0085] Step 6, discover security defects, specifically:

[0086] Through remote fuzz testing, security vulnerabilities existing in the Internet of Things and industrial control systems can be effectively detected, and the effectiveness of vulnerability mining in industrial control system devices can be improved.

[0087] Further, in the industrial control vulnerability mining method, the PLC is subjected to fuzz testing based on ModBus message similarity comparison, and the specific steps are as shown in Figure 3

[0088] Step 1, sending data packets and capturing, specifically:

[0089] First, use the host computer software to send control instructions to the ModBus protocol slave. These operations include but are not limited to reading and writing coil states, reading and writing register values, etc. At the same time, use the Wireshark tool to capture the data packets transmitted in the network, and prepare for subsequent analysis.

[0090] Step 2, data packet preprocessing, specifically:

[0091] Apply the "modbus" filter condition to all data packets captured by Wireshark to filter out only data packets related to the ModBus protocol. Further, perform deduplication processing on the filtered data packets to form a set of data packets to be analyzed.

[0092] Step 3, protocol data packet analysis and typical message list construction, specifically:

[0093] Select the first message from the set of data packets to be analyzed and add it to the typical message list. Then, iterate through the remaining reply messages and calculate the edit distance between each message and all messages in the typical message list. Based on whether the edit distance exceeds a set threshold, decide whether to add the current message to the typical message list, making it a typical message, and initialize its similarity list to empty (exceeding case); or classify it in the similar message list of the most similar typical message (not exceeding case).

[0094] Step 4, obtaining a seed list based on the typical message list, specifically:

[0095] Evaluate each message in the typical message list and the number of similar messages. If the number of similar messages of a typical message is less than a preset threshold, remove it from the list. Then, construct a seed list based on the remaining typical messages, specifically: iterate through the reduced typical message list, and add the current message and the least similar sending message in its similar message list to the seed list.

[0096] Step 5, obtaining abnormal data packets based on the seed list, specifically:

[0097] ​For each packet in the seed list, find its corresponding sending packet and perform mutation processing on it. Mutation methods can include bit flipping, performing integer addition or subtraction arithmetic operations, or replacing special content, thereby obtaining malformed data packets.

[0098] Step 6, based on the malformed data packets, the target device is subjected to vulnerability mining, specifically:

[0099] Potential vulnerabilities are detected by sending malformed data packets to the target device and monitoring the response. If no response packet is received for the malformed data packet, a probe data packet (such as ICMP or TCP SYN) is sent to check the status of the target device. If the target device does not respond, it can be determined that the device may have crashed. At this time, a POC script is written based on the malformed data packet that caused the crash to verify the existence of the vulnerability.

[0100] Step 7, loop and end condition, specifically:

[0101] According to the predetermined number of mutations, each packet in the seed list is subjected to mutation and testing in turn. Once all seeds have completed the specified number of mutations, the entire process ends.

[0102] In an embodiment, a security assessment of a factory industrial control system is described as an application scenario:

[0103] 1. Virtual-real environment setup:

[0104] Simulate the factory DCS network through a drag-and-drop topology builder, integrate real PLC (Siemens S7-1500) and virtual MES system;

[0105] Configure link packet loss rate (5%) to simulate industrial field network fluctuations;

[0106] Use the drag-and-drop topology builder to design an industrial control network architecture that includes firewalls and switches.

[0107] 2. Vulnerability detection process:

[0108] Parse S7 protocol communication data blocks and extract read-write instruction semantic rules;

[0109] Capture S7 protocol traffic, calculate packet similarity, and select 10 typical data packets (similarity threshold > 75%);

[0110] Generate a seed list and perform mutations according to protocol field rules (such as tampering with data block addresses and injecting abnormal function codes);

[0111] After sending the malformed data packets, confirm the PLC status through TCP half-connection detection.

[0112] 3. Result output:

[0113] A vulnerability (CVE-2023-XXXX) was discovered in the PLC, which allows unauthorized data block writes with a CVSS score of 9.0.

[0114] The platform automatically generates a repair report, recommending enabling encrypted communication and limiting illegal instruction execution.

[0115] The various embodiments described in this specification are presented for the purpose of illustration and description. Each of the embodiments highlights a different aspect of the disclosure. The embodiments are not mutually exclusive, and some embodiments can be combined with one another. The embodiments disclosed herein are not the only way to implement the methods and apparatuses described in this specification. The disclosure can be implemented in other ways, and should not be limited to the embodiments disclosed herein.

[0116] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present disclosure. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security testing platform for industrial control software based on a combination of virtual and real technologies, characterized in that, include: The test monitoring sub-platform includes a main operation console and multiple auxiliary operation consoles, which are used to centrally control the operation of the simulation environment and test tools, provide visual output of the test environment, the object under test and threat behavior, and record and analyze test data to quantitatively assess security risks. A security testing toolset for monitoring the status parameters of industrial control systems and detecting abnormal behavior of the industrial control systems, and performing threat injection tests; Threat injection testing includes port scanning / operating system probing testing, fuzzing testing, authentication attack testing, logic attack testing, command execution testing, authorization attack testing, and client attack testing. The specific steps of the fuzzing test are as follows: Acquire network data from the target device, and preprocess the network data to generate a set of data packets to be analyzed; The first message in the set of data packets to be analyzed is added to the typical message list, and the other messages are added to the message list to be processed. The message list to be processed is traversed, and the distance data between the current message to be processed and all typical messages in the typical message list is calculated. Typical data packets are then selected based on the distance data. An initial typical message list is constructed based on the typical data packets, and the initial typical message list is reduced based on a preset list length threshold to obtain a typical message list. A seed list is constructed based on each typical message in the typical message list and its corresponding sent message, the similar message with the largest distance data to the typical message in the similarity list of each typical message, and the sent message corresponding to the similar message. The transmitted messages in the seed list are mutated to generate multiple malformed data packets; The target device is remotely fuzz-tested using multiple malformed data packets to identify security flaws in the industrial control system. The steps for obtaining the typical data packet are as follows: Step 21: Add the first message in the set of data packets to be analyzed to the typical message list, and merge the other messages into the message list to be processed; Step 22: Select any message to be processed from the list of messages to be processed, calculate the distance data between the message to be processed and each typical message in the list of typical messages, convert the distance data into similarity values, and extract the maximum similarity value; Step 23: Determine whether the maximum similarity value is less than the preset similarity threshold. If so, merge the message to be processed into the typical message list and initialize its similarity list. If not, the message to be processed is added to the similarity list of the typical message corresponding to the maximum similarity value; Step 24: Repeat steps 22-24 until the processed message list is empty; A security information database is used to store the defect information database, software and hardware vulnerability database, network protocol feature database, and test case database of the industrial control system. The simulation environment includes virtual devices, virtual subsystems, and a virtual MES, which are used to build the complete operating environment of the industrial control system through simulation. Run a scenario library to construct test scenarios based on the virtual device, the virtual subsystem, and the virtual MES according to preset standards.

2. The industrial control software security testing platform based on virtual-real integration according to claim 1, characterized in that, The security testing toolset also includes a threat access sub-platform, which provides entry points for external threat sources that can act on the industrial control system.

3. The industrial control software security testing platform based on virtual-real integration according to claim 1, characterized in that, It also includes a simulation access sub-platform, which provides hardwired ports and communication interfaces to connect to the industrial control system.

4. The industrial control software security testing platform based on virtual-real integration according to claim 1, characterized in that, The mutation processing methods include: bitwise flipping, arithmetic operations, and content replacement.

5. The industrial control software security testing platform based on virtual-real integration according to claim 1, characterized in that, The specific steps of the remote fuzz test are as follows: The malformed data packet is sent to the target device; if no response packet is received, a probe packet is sent. If the probe does not respond, the target device is determined to be inoperable, and vulnerability verification is performed based on the malformed data packet.

Images