Vulnerability mining and security verification system for marine control network

Abstract

The invention discloses a vulnerability mining and security verification system for a marine control network. The system comprises a vulnerability mining unit and a network attack and security verification unit, wherein the vulnerability mining unit is used for known vulnerability detection, unknown vulnerability mining, vulnerability positioning and vulnerability analysis and management of equipment and software in the marine control network; the network attack and security verification unit is used for performing distributed network attacks based on the mining result of the vulnerability mining unit; and attack tests are respectively carried out before and after the security protection strategy is deployed, and the vulnerability mining effectiveness and the defense effect of the security protection strategy are verified. According to the vulnerability mining and security verification system, known vulnerability detection, unknown vulnerability mining, vulnerability root positioning, accurate analysis and security verification capabilities are provided for a control system, the network security risk can be effectively reduced, and the network security and stability of the system are improved.

Description

A Marine Control Network Vulnerability Discovery and Security Verification System Technical Field

[0001] This invention relates to information security technology, and in particular to a system for discovering and verifying vulnerabilities in marine control networks. Background Technology

[0002] The control system monitors, controls, protects, and manages the operation of the power system, ensuring its safe operation. The control network, acting as a bridge for data transmission between control system devices, plays a crucial role in the safe operation of the power system through its real-time performance and reliability.

[0003] With the rapid development of ship informatization and intelligentization, a large amount of information is transmitted through networks, increasing the risk of network attacks. Equipment such as switches and control cabinets in control systems are exposed to cybersecurity threats such as viruses, Trojans, and network attacks. Network attacks pose potential information security risks to the operation of the propulsion system and even ship navigation. Traditional ship control systems deploy firewalls to achieve network boundary isolation and access control, but firewalls cannot control access to network communications that do not pass through them and cannot prevent data-driven attacks. There are too many types of viruses, and they are constantly being updated. Firewalls cannot completely prevent the transmission of viruses that infect the operating system and software itself. Once the control system is attacked, it is prone to paralysis, equipment damage, and loss of power control, affecting the safe and reliable operation of the propulsion system and even endangering the safety of the entire ship.

[0004] To effectively uncover potential network risks, a network vulnerability discovery and security verification system needs to be proposed. This system can effectively uncover potential vulnerabilities and conduct precise root cause analysis, preventing power system malfunctions caused by unknown system vulnerabilities, reducing network security risks, improving system network security and stability, and ensuring the safe and reliable operation of the power system. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a system for discovering and verifying vulnerabilities in marine control networks, addressing the shortcomings of the prior art.

[0006] The technical solution adopted by this invention to solve its technical problem is: a marine control network vulnerability mining and security verification system, comprising: a vulnerability mining unit and a network attack and security verification unit; wherein, the vulnerability mining unit is used for detecting known vulnerabilities and mining unknown vulnerabilities in devices and software in the marine control network, vulnerability location, and vulnerability analysis and management; the network attack and security verification unit is used for constructing attack code and designing attack paths based on the mining results of the vulnerability mining unit, and carrying out distributed network attacks; and attack tests are carried out before and after the deployment of security protection strategies to verify the effectiveness of vulnerability mining and the defensive effect of security protection strategies.

[0007] According to the above scheme, the network attack and security verification unit realizes distributed network attacks by constructing attack code and designing attack paths.

[0008] According to the above scheme, the workflow of the vulnerability discovery unit includes the following steps: S1) Device information feature collection: Sending device identification requests to the control cabinet controller, switch, and host in the marine control network, and matching the device's response information with a preset device fingerprint feature database to obtain device feature information such as device type, brand, model, and firmware version; S2) Port scanning: Performing a full-range port scan of IP, TCP, and UDP protocols, and identifying the device's open protocol ports, operating system, and industrial control communication protocols by sending service port connection requests to the target device; S3) Known vulnerability scanning: Based on a preset control system security vulnerability feature database, the device information obtained in steps S1) and S2) is compared with... The vulnerability signature database is matched with vulnerability signatures to complete the detection of known vulnerabilities; the control system security vulnerability signature database contains industrial control vulnerability fingerprint information, which includes firmware version, communication protocol, and vulnerability signature information; S4) Unknown vulnerability mining: vulnerability location is achieved through packet data cyclic segmentation technology and binary search; S5) Vulnerability analysis and management: the results of known vulnerability detection and unknown vulnerability mining are analyzed to locate the vulnerability in the data packet, analyze potential vulnerability exploitation methods, determine the vulnerability risk level in combination with the abnormal status of the device, and generate vulnerability signature information and vulnerability mining test report; at the same time, vulnerability information is managed in a unified manner, which includes vulnerability addition, vulnerability classification, and vulnerability template configuration.

[0009] According to the above scheme, the vulnerability mining unit uses message data cyclic segmentation technology and binary search to locate vulnerabilities, specifically as follows: determine the data segmentation strategy, use cyclic segmentation to divide the data in the shipboard control network into multiple small segments, and use statistical methods, machine learning algorithms or rule engines to independently detect each data segment; then use binary search technology to quickly search for potential vulnerability points in each data segment and generate an abnormal event report.

[0010] According to the above scheme, in the process of discovering unknown vulnerabilities, a binary search technique is used to quickly search for potential vulnerability points. The intermediate point after sorting is selected for testing. If a vulnerability exists at the intermediate point, the search continues in the current half; otherwise, the search continues in the other half. The binary search process is repeated until the specific vulnerability point is located.

[0011] According to the above scheme, the vulnerability discovery test report includes: information and configuration information of the device under test, configuration and test results of all test cases, list of test failures and description of vulnerability results.

[0012] According to the above scheme, the workflow of the network attack and security verification unit includes the following steps: 1) Vulnerability exploitation: Analyze the marine control network information, identify the system vulnerabilities discovered through analysis, and determine the network attack method, attack target, attack object, and attack process; the marine control network information includes device information, open protocol ports, running service interfaces, and network topology; 2) Attack code construction: Based on the vulnerability information and vulnerability exploitation results from the vulnerability mining unit, write attack code for the device layer, control layer, and monitoring layer of the marine control system to construct the attack program; 3) Attack verification test: Run the attack program to verify the attack effect; 4) Set security protection strategies: For the discovered vulnerabilities, configure security protection strategies in the firewall module and audit module. 1) Enable security protection policies in the supervision module; the security protection policies include access control, protocol identification and parsing, security auditing, intrusion detection, device monitoring, and log collection; 5) Security protection verification: After setting the security protection policies, run the attack program to verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 6) Test without deploying new security protection policies: Remove the deployment of protection policies for vulnerability discovery, retain only the initial security protection policies, run the attack program, verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 7) Result comparison and analysis: Compare the test results of step 5) and step 6) to complete the verification of the effectiveness of vulnerability discovery and the defense effect of security protection policies.

[0013] According to the above scheme, in step 4), security protection policies are enabled in the firewall module, audit module, and monitoring module for the discovered vulnerabilities.

[0014] According to the above scheme, in step 4), the security protection strategy includes access control, protocol identification and parsing, security auditing, intrusion detection, device monitoring, and log collection.

[0015] According to the above scheme, the firewall module in the network attack and security verification unit is deployed in series between the boundaries of the shipboard control network or important control devices.

[0016] The beneficial effects of this invention are: 1. The marine control network vulnerability mining and security verification system of this invention provides the control system with the ability to detect known vulnerabilities, mine unknown vulnerabilities and locate the root cause of vulnerabilities, perform accurate analysis and security verification, reduce operational failures caused by unknown system vulnerabilities, reduce network security risks and improve the network security and stability of the system. Attached Figure Description

[0017] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the drawings: Figure 1 is a system structure diagram of an embodiment of the present invention; Figure 2 is a schematic diagram of the vulnerability mining unit of an embodiment of the present invention; Figure 3 is a schematic diagram of the network attack and security verification unit of an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] As shown in Figure 1, a marine control network vulnerability discovery and security verification system includes: a vulnerability discovery unit and a network attack and security verification unit; wherein, the vulnerability discovery unit is used for the detection of known vulnerabilities and the discovery of unknown vulnerabilities in devices and software in the marine control network, vulnerability location, and vulnerability analysis and management; the network attack and security verification unit is used to construct attack code and design attack paths based on the discovery results of the vulnerability discovery unit to carry out distributed network attacks; and to conduct attack tests before and after the deployment of security protection strategies to verify the effectiveness of vulnerability discovery and the defensive effect of security protection strategies.

[0020] The schematic diagram of the vulnerability discovery unit is shown in Figure 2. The workflow of the vulnerability discovery unit includes the following steps: S1) Device information feature collection: Sending device identification requests to the control cabinet controller, switch, and host in the marine control network, and matching the device's response information with the preset device fingerprint feature database to obtain device feature information such as device type, brand, model, and firmware version; S2) Port scanning: Performing a full-range port scan of IP, TCP, and UDP protocols, and identifying the device's open protocol ports, operating system, and industrial control communication protocols by sending service port connection requests to the target device; S3) Known vulnerability scanning: Based on the preset control system security vulnerability feature database, matching the device information obtained in steps S1) and S2) with the vulnerability features in the vulnerability feature database. Complete known vulnerability detection; the control system security vulnerability feature library contains industrial control vulnerability fingerprint information, which includes firmware version, communication protocol, and vulnerability feature information; S4) Unknown vulnerability mining: vulnerability location is achieved through message data cyclic segmentation technology and binary search; determine the data segmentation strategy, use cyclic segmentation to divide the data in the marine control network into multiple small segments, and use statistical methods, machine learning algorithms or rule engines to independently detect each data segment; then use binary search technology to quickly search for potential vulnerability points in each data segment, and test by selecting the middle point after sorting. If there is a vulnerability in the middle point, continue searching in the current half segment; otherwise, search in the other half segment. Repeat the binary search process until the specific vulnerability point is located, and generate an abnormal event report.

[0021] S5) Vulnerability Analysis and Management: Analyze the results of known vulnerability detection and unknown vulnerability discovery, locate the vulnerability in the data packet, analyze potential vulnerability exploitation methods, determine the vulnerability risk level in combination with abnormal device status, and generate vulnerability feature information and vulnerability discovery test reports; the vulnerability discovery test reports include: information and configuration information of the device under test, configuration and test results of all test cases, list of test failures and description of vulnerability results.

[0022] At the same time, vulnerability information is managed in a unified manner, which includes adding vulnerabilities, classifying vulnerabilities, and configuring vulnerability templates.

[0023] The schematic diagram of the network attack and security verification unit is shown in Figure 3. The workflow of the network attack and security verification unit includes the following steps: 1) Vulnerability exploitation: Analyze the marine control network information, identify the system vulnerabilities discovered through analysis, and determine the network attack method, attack target, attack object, and attack process; the marine control network information includes device information, open protocol ports, running service interfaces, and network topology; 2) Attack code construction: Based on the vulnerability information and vulnerability exploitation results from the vulnerability mining unit, write attack code for the device layer, control layer, and monitoring layer of the marine control system to construct the attack program; 3) Attack verification test: Run the attack program to verify the attack effect; 4) Set up security protection strategies: For the discovered vulnerabilities, configure the firewall mode... Enable security protection policies in the block, audit module, and supervision module; the security protection policies include access control, protocol identification and parsing, security audit, intrusion detection, device monitoring, and log collection; 5) Security protection verification: After setting the security protection policies, run the attack program to verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 6) Test without deploying new security protection policies: Remove the deployment of protection policies for vulnerability discovery, retain only the initial security protection policies, run the attack program, verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 7) Result comparison and analysis: Compare the test results of step 5) and step 6) to complete the verification of the effectiveness of vulnerability discovery and the defense effect of security protection policies.

[0024] In the marine control network vulnerability discovery and security verification system, both the vulnerability discovery unit and the network attack and security verification unit are equipped with standard RJ45 interfaces. The firewall module in the network attack and security verification unit is deployed in series at the control system network boundary or between important control devices. Other units and modules are connected to the control system switch via bypass access, thereby connecting to the control system.

[0025] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A system for discovering and verifying vulnerabilities in marine control networks, characterized in that, include: The system comprises a vulnerability discovery unit and a network attack and security verification unit. The vulnerability discovery unit is used for the detection of known vulnerabilities and the discovery of unknown vulnerabilities in equipment and software in the shipboard control network, as well as vulnerability location, analysis, and management. The network attack and security verification unit is used for conducting distributed network attacks based on the discovery results of the vulnerability discovery unit. Attack tests are conducted before and after the deployment of security protection strategies to verify the effectiveness of vulnerability discovery and the defensive effect of security protection strategies.

2. The marine control network vulnerability discovery and security verification system according to claim 1, characterized in that, The workflow of the vulnerability discovery unit includes the following steps: S1) Device information feature collection: Sending device identification requests to the control cabinet controller, switch, and host in the marine control network, and matching the device's response information with a preset device fingerprint feature database to obtain device feature information such as device type, brand, model, and firmware version; S2) Port scanning: Performing a full-range port scan of IP, TCP, and UDP protocols, and identifying the device's open protocol ports, operating system, and industrial control communication protocols by sending service port connection requests to the target device; S3) Known vulnerability scanning: Based on a preset control system security vulnerability feature database, comparing the device information obtained in steps S1) and S2) with the vulnerability features... The vulnerability features in the vulnerability database are matched to complete the detection of known vulnerabilities; the control system security vulnerability feature database contains industrial control vulnerability fingerprint information, which includes firmware version, communication protocol, and vulnerability feature information; S4) Unknown vulnerability mining: vulnerability location is achieved through message data cyclic segmentation technology and binary search; S5) Vulnerability analysis and management: the results of known vulnerability detection and unknown vulnerability mining are analyzed to locate the vulnerability in the data packet, analyze potential vulnerability exploitation methods, determine the vulnerability risk level in combination with the abnormal status of the device, and generate vulnerability feature information and vulnerability mining test report; at the same time, vulnerability information is uniformly managed, which includes vulnerability addition, vulnerability classification, and vulnerability template configuration.

3. The marine control network vulnerability discovery and security verification system according to claim 1, characterized in that, In the vulnerability discovery unit, vulnerability location is achieved through message data cyclic segmentation technology and binary search, specifically as follows: a data segmentation strategy is determined, and the data in the marine control network is divided into multiple small segments using cyclic segmentation. Each data segment is independently detected using statistical methods, machine learning algorithms, or rule engines. Then, within each data segment, binary search technology is used to quickly search for potential vulnerability points and generate an abnormal event report.

4. The marine control network vulnerability discovery and security verification system according to claim 3, characterized in that, In the process of discovering unknown vulnerabilities, a binary search technique is used to quickly search for potential vulnerability points. The middle point after sorting is selected for testing. If a vulnerability exists at the middle point, the search continues in the current half; otherwise, the search continues in the other half. The binary search process is repeated until the specific vulnerability point is located.

5. The marine control network vulnerability discovery and security verification system according to claim 2, characterized in that, The vulnerability discovery test report includes: information and configuration information of the device under test, configuration and test results of all test cases, list of test failures and description of vulnerability results.

6. The marine control network vulnerability discovery and security verification system according to claim 1, characterized in that, The network attack and security verification unit implements distributed network attacks by constructing attack code and designing attack paths.

7. The marine control network vulnerability discovery and security verification system according to claim 1, characterized in that, The workflow of the network attack and security verification unit includes the following steps: 1) Vulnerability exploitation: Analyze marine control network information, identify system vulnerabilities discovered through analysis, and determine the network attack method, attack target, attack object, and attack process; the marine control network information includes device information, open protocol ports, running service interfaces, and network topology; 2) Attack code construction: Based on the vulnerability information and vulnerability exploitation results from the vulnerability mining unit, write attack code for the device layer, control layer, and monitoring layer of the marine control system to construct the attack program; 3) Attack verification test: Run the attack program to verify the attack effect; 4) Set security protection strategies: For the discovered vulnerabilities, set security protection strategies in the firewall module, audit module, and monitoring module. Enable security protection policies in the module; the security protection policies include access control, protocol identification and parsing, security auditing, intrusion detection, device monitoring, and log collection; 5) Security protection verification: After setting the security protection policies, run the attack program to verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 6) Test without deploying new security protection policies: Remove the deployment of protection policies for vulnerability discovery, retain only the initial security protection policies, run the attack program, verify whether the attack behavior is identified and blocked, and generate log events and security alarm events; 7) Result comparison and analysis: Compare the test results of step 5) and step 6) to complete the verification of the effectiveness of vulnerability discovery and the defense effect of the security protection policies.

8. The marine control network vulnerability discovery and security verification system according to claim 7, characterized in that, In step 4), security protection policies are enabled in the firewall module, audit module, and monitoring module for the discovered vulnerabilities.

9. The marine control network vulnerability discovery and security verification system according to claim 7, characterized in that, In step 4), the security protection strategy includes access control, protocol identification and parsing, security auditing, intrusion detection, device monitoring, and log collection.

10. The marine control network vulnerability discovery and security verification system according to claim 7, characterized in that, The firewall modules in the network attack and security verification unit are deployed in series at the boundary of the shipboard control network or between important control devices.

Images