Vulnerability identification and analysis system for control systems

Abstract

The present invention relates to a system for identifying and analyzing vulnerabilities in a control system, and more specifically, to a system for identifying and analyzing vulnerabilities in a control system by utilizing input asset attribute information and known vulnerability information, and by analyzing vulnerabilities in a control system by reflecting the characteristics of the operating environment based on the asset attribute information. A vulnerability identification and analysis system for a control system according to the present invention comprises: a storage unit storing known vulnerability information for a control system that is the subject of vulnerability identification and analysis; an input unit receiving asset attribute information for the control system from a user; an identification unit that compares the asset attribute information input into the input unit with the known vulnerability information stored in the storage unit and derives identified vulnerability information of the control system through the extraction of vulnerability identifier information; an analysis unit that derives vulnerability analysis information of the control system by reflecting the environmental characteristics of the control system based on the asset attribute information input into the input unit; and an information provision unit that provides the vulnerability information identified by the identification unit and the vulnerability analysis information analyzed by the analysis unit to the user.

Description

Technology Field

[0001] The present invention relates to a system for identifying and analyzing vulnerabilities in a control system, and more specifically, to a system for identifying and analyzing vulnerabilities in a control system by utilizing input asset attribute information and known vulnerability information, and by analyzing vulnerabilities in a control system by reflecting the characteristics of the operating environment based on the asset attribute information. Background Technology

[0002] Control systems consist of various technical components, such as sensors, devices, and actuators, for monitoring and controlling production processes, and these are designed to support specific industrial processes.

[0003] Among them, the Industrial Control System (ICS) is a computer-based system that is essential for the effective monitoring and control of major national infrastructure, such as power, gas, water, sewage, oil, and transportation systems.

[0004] Due to the nature of industrial control systems, they require high reliability and continuous operation, and differ significantly from general information technology systems in terms of closed systems, resource specificity, and operational availability.

[0005] Because industrial control systems primarily operate in closed network environments, once installed, structural changes or upgrades are difficult, and they have a long lifespan.

[0006] Due to these characteristics, exposure to cyber threats can cause significant risks to the lives, livelihoods, property, and national economy of the public.

[0007] In response to this, it is necessary to identify potential vulnerabilities within industrial control systems, analyze them, and implement appropriate countermeasures.

[0008] However, most existing vulnerability analysis systems are developed and evaluated based on general information technology environments.

[0009] In particular, the Common Vulnerability Scoring System (CVSS), which indicates the severity of vulnerabilities, is difficult to apply to existing control system environments because it fails to reflect the characteristics of the control system's operating environment.

[0010] This suggests that it is necessary to respond rapidly to cybersecurity threats targeting industrial control system environments and establish appropriate security measures, as the specific requirements of industrial control system environments are not sufficiently reflected.

[0011] As prior art, Korean Published Patent Application No. 10-2020-0052755 proposes a 'device and method for checking cyber security vulnerabilities and regulatory guidelines'.

[0012] The above prior art proposes a vulnerability and regulatory guideline inspection device as a device for inspecting cyber security vulnerabilities and regulatory guidelines of an industrial control system, comprising: an integrated user interface module that receives configuration items necessary for performing vulnerability and regulatory guideline inspection from a user; a vulnerability inspection module that inspects vulnerabilities of a first device based on identification information of the first device when the configuration items include a request for vulnerability inspection of a first device of the industrial control system; a regulatory guideline inspection module that inspects regulatory guidelines for the first device by executing an inspection plugin corresponding to the first device when the configuration items include a request for regulatory guideline inspection of the first device of the industrial control system; and an integrated inspection module that inspects vulnerabilities of the second device using serial communication commands when the configuration items include a request for vulnerability inspection of a second device of the industrial control system.

[0013] However, the aforementioned conventional technology is configured to check for vulnerabilities only on devices for which a user has requested an inspection, which has the disadvantage of making it difficult to identify vulnerabilities in the entire control system. Furthermore, it has limitations in assigning priority for vulnerability mitigation in control system environments where immediate vulnerability removal is difficult because it cannot analyze vulnerabilities that reflect the characteristics of the control system's operating environment. The problem to be solved

[0014] The present invention has been devised to solve the problems of the prior art as described above. The objective of the present invention is to provide a control system vulnerability identification and analysis system capable of identifying vulnerabilities in a control system by utilizing input asset attribute information and known vulnerability information, and analyzing vulnerabilities in a control system by reflecting operating environment characteristics based on asset attribute information. means of solving the problem

[0015] To achieve the above objectives, the vulnerability identification and analysis system of a control system according to the present invention comprises: a storage unit storing known vulnerability information regarding a control system that is the subject of vulnerability identification and analysis; an input unit receiving asset attribute information regarding the control system from a user; an identification unit that compares the asset attribute information input into the input unit with the known vulnerability information stored in the storage unit and derives identified vulnerability information of the control system through the extraction of vulnerability identifier information; an analysis unit that derives vulnerability analysis information of the control system by reflecting the environmental characteristics of the control system based on the asset attribute information input into the input unit; and an information provision unit that provides the vulnerability information identified by the identification unit and the vulnerability analysis information analyzed by the analysis unit to the user.

[0016] Here, the storage unit is composed of a plurality of databases in which the known vulnerability information is stored by type, wherein the plurality of databases include a control system vulnerability information DB, a vulnerable asset identification information DB, a public vulnerability information DB, and a vulnerability severity assessment information DB.

[0017] Here, the input unit requests the user to input asset attribute information by classifying it into multiple items including basic information, communication, system environment, location, whether a security policy is applied (technology), whether a security policy is applied (operation), and importance evaluation; if there is any asset attribute information that has not been entered among the asset attribute information requested from the user, the user is requested to re-enter it; and if all the asset attribute information requested from the user has been entered, the entered asset attribute information is stored in the asset attribute information DB.

[0018] Here, the input unit is characterized by including the asset name and model name of the asset in the basic information item, including wired and wireless communication information of the asset in the communication item, including application information utilized within the asset in the system environment item, including information on the location where the asset is situated with a certain degree of risk in the location item, including technical and operational information for access control to the asset in the security policy application status (technical) item and the security policy application status (operational) item, respectively, and including information on what impact an attack on the asset could have on the entire system in the importance assessment item.

[0019] Herein, the identification unit includes an asset-specific vulnerability identification module that compares asset attribute information entered into the input unit with known vulnerability information stored in the storage unit and performs an analysis based on the comparison result; wherein the asset-specific vulnerability identification module compares the asset attribute information entered into the input unit with the information stored in the control system vulnerability information DB, vulnerable asset identification information DB, and public vulnerability information DB of the storage unit based on the asset name and model name, respectively, and if a matching asset name or model name exists as a result of the comparison, extracts vulnerability identifier information within the information stored in the control system vulnerability information DB, vulnerable asset identification information DB, and public vulnerability information DB of the storage unit, respectively, and integrates the respective extracted vulnerability identifier information to derive the identified vulnerability information of the control system.

[0020] Herein, the analysis unit includes a vulnerability severity re-evaluation module that compares asset attribute information entered into the input unit with known vulnerability information stored in the storage unit and performs an analysis based on the comparison result; wherein the vulnerability severity re-evaluation module compares the asset attribute information entered into the input unit with information stored in the vulnerability severity evaluation information DB of the storage unit, and if, as a result of the comparison, vulnerability severity evaluation information corresponding to the asset attribute information entered into the input unit exists in the vulnerability severity evaluation information DB of the storage unit, it performs a severity re-evaluation for each according to a predetermined evaluation factor, and integrates the vulnerability severity evaluation information re-evaluated for each according to the evaluation factor to derive the final vulnerability analysis information of the control system.

[0021] Here, the vulnerability severity re-evaluation module is characterized by including, as evaluation factors for performing the severity re-evaluation, attack vector, attack complexity, required privileges, user interaction, asset location, asset impact, attack code maturity, scope, and vulnerability confidence present in the vulnerability severity evaluation information.

[0022] In addition, the control system subject to the identification and analysis of the above-mentioned vulnerabilities is characterized as an Industrial Control System (ICS) for national critical infrastructure, including power, gas, water, sewage, oil, and transportation systems. Effects of the invention

[0023] With the above configuration, the vulnerability identification and analysis system of a control system according to the present invention has the advantage of effectively helping to determine priority for vulnerability mitigation in a control system environment where immediate vulnerability removal is difficult, by providing vulnerability analysis information based on diverse information and asset attribute information that reflect environmental characteristics regarding vulnerabilities occurring in each asset. Brief explanation of the drawing

[0024] FIG. 1 is a configuration diagram of a vulnerability identification and analysis system for a control system according to an embodiment of the present invention. FIG. 2 is an information processing flowchart of a vulnerability identification and analysis system for a control system according to an embodiment of the present invention. FIG. 3 is an information processing flowchart of an input unit according to an embodiment of the present invention. FIG. 4 is an information processing flowchart of an identification unit according to an embodiment of the present invention. FIG. 5 is an information processing flowchart of an analysis unit according to an embodiment of the present invention. Specific details for implementing the invention

[0025] Hereinafter, the vulnerability identification and analysis system of a control system according to the present invention will be described in more detail with reference to the embodiments illustrated in the drawings.

[0026] FIG. 1 is a configuration diagram of a vulnerability identification and analysis system for a control system according to an embodiment of the present invention, FIG. 2 is an information processing flowchart of a vulnerability identification and analysis system for a control system according to an embodiment of the present invention, FIG. 3 is an information processing flowchart of an input unit according to an embodiment of the present invention, FIG. 4 is an information processing flowchart of an identification unit according to an embodiment of the present invention, and FIG. 5 is an information processing flowchart of an analysis unit according to an embodiment of the present invention.

[0027] Referring to FIGS. 1 and 2, a vulnerability identification and analysis system of a control system according to an embodiment of the present invention includes a storage unit (100), an input unit (200), an identification unit (300), an analysis unit (400), and an information providing unit (500).

[0028] In one embodiment of the present invention, the control system subject to vulnerability identification and analysis may be an Industrial Control System (ICS) for national critical infrastructure including power, gas, water, sewage, oil, and transportation systems.

[0029] The above storage unit (100) is configured to store known vulnerability information regarding a control system that is the target of vulnerability identification and analysis.

[0030] The above storage unit (100) Through specific vulnerability information database construction technology The known vulnerability information is stored in a plurality of databases classified by type. In one embodiment of the present invention, the plurality of databases may include a control system vulnerability information DB (101), a vulnerable asset identification information DB (102), a public vulnerability information DB (103), and a vulnerability severity assessment information DB (104), as shown in FIG. 1.

[0031] Here, the vulnerability information database construction technology may be a technology comprising: an information collection unit that collects vulnerability information of a control system and vulnerability-related surrounding information using a data crawler; a connection relationship identification unit that identifies the connection relationships between the information using a mapping script for the vulnerability information and surrounding information collected through the information collection unit; a classification unit that classifies the vulnerability information and surrounding information based on vulnerability asset identification information according to the connection relationships between the vulnerability information and surrounding information identified by the connection relationship identification unit; and a storage unit that stores the vulnerability information and surrounding information regarding the vulnerable asset in the form of a dictionary having key-value values ​​based on the information classified by the classification unit.

[0032] As will be described later, the information (or entities) stored in the above-mentioned control system vulnerability information DB (101), vulnerability asset identification information DB (102), and public vulnerability information DB (103) are used to derive vulnerability information (301) identified in the identification unit (300), and the information (or entities) stored in the above-mentioned vulnerability severity assessment information DB (104) can be used in the analysis unit (400) for vulnerability analysis information (401).

[0033] The above input unit (200) is configured to receive asset attribute information regarding the control system from a user who manages and uses the control system.

[0034] In one embodiment of the present invention, the input unit (200) is configured to request the user to input asset attribute information by classifying it into a plurality of items including basic information, communication, system environment, location, whether a security policy is applied (technology), whether a security policy is applied (operation), and importance evaluation, as shown in FIG. 3.

[0035] Here, the above basic information item specifies basic information including asset name, model name, etc., such as the name and version of the asset, and may consist of a total of 10 attributes: asset type, asset type details, manufacturer / supplier, asset registration name, model version, whether HMI is used, whether the media connection port is physically blocked, whether the maintenance device connection port is physically blocked, whether the media connection function is available, and whether the maintenance connection device is used.

[0036] The above communication items are matters concerning wired and wireless communication information of the asset and may consist of a total of six attributes: communication connectivity, communication protocol, communication interface, whether unidirectional communication is enabled, whether wireless communication is enabled, and type of wireless communication.

[0037] The above system environment item is a matter concerning application information used within the asset and may consist of a total of 7 attributes: application name, application version, whether application service is used, firmware name, firmware version, operating system name, and operating system version.

[0038] The above location item is a matter concerning the location where the asset has a certain degree of risk in order to reflect the characteristics of the control system environment, and may consist of a total of two attributes: the physical location of the asset and the network security layer.

[0039] The above security policy application status (technical) item relates to technical matters for access control and may consist of two attributes: whether a host firewall is applied and whether encrypted communication is enabled. Additionally, the security policy application status (operational) item relates to operational matters for access control and may consist of three attributes: asset access rights, whether work is approved, and whether account management functions are enabled.

[0040] Finally, the above importance assessment item concerns the potential impact on the entire system when an attack is carried out on the asset, and may consist of a total of one attribute of Consequence Classification based on the NRC (Nuclear Regulatory Commission) NEI 13-10, Cyber ​​Security Control Assessment criteria.

[0041] After that, the input unit (200) is configured to request the user to re-enter any asset attribute information that has not been entered among the asset attribute information requested for input by the user, and to store the entered asset attribute information in the asset attribute information DB (201) so that it can be used to facilitate vulnerability identification and analysis in the future.

[0042] The identification unit (300) is configured to compare asset attribute information input into the input unit (200) with known vulnerability information stored in the storage unit (100) and to derive identified vulnerability information (301) of the control system through the extraction of vulnerability identifier information.

[0043] In one embodiment of the present invention, the identification unit (300) includes an asset-specific vulnerability identification module (310) that compares asset attribute information input into the input unit (200) with known vulnerability information stored in the storage unit (100) and performs an analysis based on the comparison result.

[0044] Figure 4 illustrates the information processing flowchart of the identification unit (300).

[0045] Referring to FIG. 4, the asset-specific vulnerability identification module (310) is configured to compare the asset attribute information entered into the input unit with the information stored in the control system vulnerability information DB (101), vulnerable asset identification information DB (102), and public vulnerability information DB (103) of the storage unit (100) based on the asset name and model name.

[0046] If a matching asset name or model name exists as a result of comparison, vulnerability identifier information is extracted from the information stored in the control system vulnerability information DB (101), vulnerable asset identification information DB (102), and public vulnerability information DB (103) of the storage unit (100), respectively, and if no matching asset name or model name exists as a result of comparison, the entity is configured to be ignored.

[0047] After that, the above asset-specific vulnerability identification module (310) is configured to integrate the respective extracted vulnerability identifier information to derive the identified vulnerability information (301) of the control system.

[0048] By configuring the identification unit (300) as described above, the present invention can identify overall vulnerabilities of the control system by utilizing input asset attribute information and known vulnerability information.

[0049] The above analysis unit (400) is configured to derive vulnerability analysis information of the control system by reflecting the environmental characteristics of the control system based on asset attribute information input into the above input unit (200).

[0050] In one embodiment of the present invention, the analysis unit (400) includes a vulnerability severity re-evaluation module (410) that compares asset attribute information input into the input unit (200) with known vulnerability information stored in the storage unit (100) and performs an analysis based on the comparison result.

[0051] Figure 5 illustrates the information processing flowchart of the analysis unit (400).

[0052] Referring to FIG. 5, the vulnerability severity re-evaluation module (410) is configured to compare asset attribute information entered into the input unit (200) with information stored in the vulnerability severity evaluation information DB (104) of the storage unit (100).

[0053] As a result of comparison, if vulnerability severity evaluation information corresponding to the asset attribute information entered into the input unit (200) exists in the vulnerability severity evaluation information DB (104) of the storage unit (100), a severity re-evaluation is performed according to the determined evaluation element for each, and if it does not exist, the vulnerability analysis of the vulnerability-specific severity re-evaluation module (410) is stopped.

[0054] Here, the evaluation element for performing the severity re-evaluation may include nine elements, namely attack vector, attack complexity, required privileges, user interaction, asset location, asset impact, attack code maturity, scope, and vulnerability confidence, which exist within the vulnerability severity evaluation information so as to reflect the environmental characteristics of the control system.

[0055] The above evaluation factors are classified into an abuse possibility index of six factors and an impact index of three factors.

[0056] The exploitability index consists of elements of attack vector, attack complexity, required privileges, user interaction, scope, and attack code maturity, and these elements are evaluated based on the inherent characteristics of the vulnerability and the attribute information of the asset.

[0057] In addition, based on publicly available exploit and abuse information, we consider how significant and easy the vulnerabilities utilized by attackers are to enable attacks within the control system environment.

[0058] The impact index consists of asset location and asset impact factors, and an assessment is performed on the operational environmental characteristics of the asset and the ripple effects in the event of a breach. Asset location is evaluated based on the specific area where the asset is situated, and the closer it is to critical facilities, the higher the security level is deemed to be.

[0059] In addition, asset impact is assessed based on the influence of assets compromised by vulnerability exploitation.

[0060] After that, the vulnerability severity re-evaluation module (410) is configured to integrate vulnerability severity evaluation information re-evaluated according to the evaluation elements to derive the final vulnerability analysis information (401) of the control system.

[0061] By configuring the analysis unit (400) as described above, the present invention provides vulnerability analysis information (401) based on various information and asset attribute information that reflect environmental characteristics regarding vulnerabilities occurring in each asset, thereby helping to effectively derive priority for vulnerability mitigation in a control system environment where immediate vulnerability removal is difficult.

[0062] The information providing unit (500) is configured to provide vulnerability information (301) identified by the identification unit (300) and vulnerability analysis information (401) analyzed by the analysis unit (400) to the user.

[0063] By using the identified vulnerability information (301) and vulnerability analysis information (401) provided by the information provider (500), the user can overcome the limitations of existing information technology vulnerability analysis methods and present vulnerability diagnosis and security measures that can satisfy requirements suitable for industrial control system characteristics.

[0064] The vulnerability identification and analysis system of a control system described above and illustrated in the drawings is merely one embodiment for implementing the present invention and should not be interpreted as limiting the technical scope of the present invention. The scope of protection of the present invention is determined solely by the matters described in the following claims, and embodiments that are improved or modified without departing from the gist of the present invention shall be deemed to fall within the scope of protection of the present invention insofar as they are obvious to those skilled in the art to which the present invention belongs. Explanation of the symbols

[0065] 100 storage units 101 Control System Vulnerability Information DB 102 Vulnerability Self-Identification Information DB 103 Public Vulnerability Information DB 104 Vulnerability Severity Assessment Information DB 200 Input Section 201 Asset Attribute Information DB 300 Identification Unit 310 Asset-based Vulnerability Identification Module 301 Identified Vulnerability Information 400 Analysis Department 410 Vulnerability Severity Reassessment Module 401 Vulnerability Analysis Information 500 Information Provision Department

Claims

Claim 1 A vulnerability identification and analysis system for a control system comprising: a storage unit storing known vulnerability information for a control system that is the subject of vulnerability identification and analysis; an input unit receiving asset attribute information for the control system from a user; an identification unit that compares the asset attribute information entered in the input unit with the known vulnerability information stored in the storage unit and derives the identified vulnerability information of the control system through the extraction of vulnerability identifier information; an analysis unit that derives vulnerability analysis information of the control system by reflecting the environmental characteristics of the control system based on the asset attribute information entered in the input unit; and an information provision unit that provides the vulnerability information identified by the identification unit and the vulnerability analysis information analyzed by the analysis unit to the user. Claim 2 A vulnerability identification and analysis system for a control system, wherein, in claim 1, the storage unit is composed of a plurality of databases in which the known vulnerability information is stored by type, and the plurality of databases include a control system vulnerability information DB, a vulnerable asset identification information DB, a public vulnerability information DB, and a vulnerability severity assessment information DB. Claim 3 A vulnerability identification and analysis system for a control system according to paragraph 2, wherein the input unit requests the user to input asset attribute information by classifying it into multiple items including basic information, communication, system environment, location, whether a security policy is applied (technology), whether a security policy is applied (operation), and importance evaluation; if there is asset attribute information that has not been entered among the asset attribute information requested from the user, the user is requested to re-enter it; and if all the asset attribute information requested from the user is entered, the entered asset attribute information is stored in an asset attribute information DB. Claim 4 A vulnerability identification and analysis system for a control system, characterized in that, in paragraph 3, the input unit includes the asset name and model name of the asset in the basic information item, includes wired and wireless communication information of the asset in the communication item, includes application information utilized within the asset in the system environment item, includes information on the location where the asset is located with a certain degree of risk in the location item, includes technical and operational information for access control to the asset in the security policy application status (technical) item and the security policy application status (operational) item, respectively, and includes information on how the entire system may be affected when an attack is performed on the asset in the importance evaluation item. Claim 5 In paragraph 2, the identification unit comprises an asset-specific vulnerability identification module that compares asset attribute information input into the input unit with known vulnerability information stored in the storage unit and performs analysis based on the comparison result; wherein the input unit includes the asset name and model name of the corresponding asset in the input asset attribute information, and the asset-specific vulnerability identification module compares the asset attribute information input into the input unit with the information stored in the control system vulnerability information DB, vulnerable asset identification information DB, and public vulnerability information DB of the storage unit based on the asset name and model name, respectively, and if a matching asset name or model name exists as a result of the comparison, extracts vulnerability identifier information within the information stored in the control system vulnerability information DB, vulnerable asset identification information DB, and public vulnerability information DB of the storage unit, respectively, and integrates the respective extracted vulnerability identifier information to derive the identified vulnerability information of the control system. Claim 6 In paragraph 2, the analysis unit comprises a vulnerability severity re-evaluation module that compares asset attribute information entered into the input unit with known vulnerability information stored in the storage unit and performs an analysis based on the comparison result; wherein the vulnerability severity re-evaluation module compares the asset attribute information entered into the input unit with information stored in the vulnerability severity evaluation information DB of the storage unit, and if, as a result of the comparison, vulnerability severity evaluation information corresponding to the asset attribute information entered into the input unit exists in the vulnerability severity evaluation information DB of the storage unit, it performs a severity re-evaluation for each according to a predetermined evaluation factor, and integrates the vulnerability severity evaluation information re-evaluated for each according to the evaluation factor to derive the final vulnerability analysis information of the control system. Claim 7 A vulnerability identification and analysis system for a control system, characterized in that, in claim 6, the vulnerability severity re-evaluation module includes, as evaluation elements for performing the severity re-evaluation, an attack vector, attack complexity, required privileges, user interaction, asset location, asset impact, attack code maturity, scope, and vulnerability confidence present in the vulnerability severity evaluation information. Claim 8 A control system vulnerability identification and analysis system, characterized in that, in any one of claims 1 to 7, the control system subject to vulnerability identification and analysis is an Industrial Control System (ICS) for national critical infrastructure including power, gas, water, sewage, oil, and transportation systems.

Images