Semi-passive industrial control network security analysis tool and method based on Bayesian attack graph

Abstract

The invention provides a semi-passive industrial control network security analysis tool and method based on a Bayesian attack graph, and relates to the technical field of network security. The method includes: a semi-passive information acquisition module: acquiring active scanning reports, network message data and management The combination suggested by the staff is corrected and used as an input file; build the asset list module: build the asset list, and generate the .P file as the input file of the attribute attack graph generation module and the Bayesian attack graph generation module; the attribute attack graph generation module: Input template network topology information and node information to generate attack paths; Bayesian attack graph generation module: based on the network information and logic rules recorded by Datalog statements, comprehensively analyze the information of the entire network, and finally generate all possible attack graphs. The invention can have strong compatibility with respect to industrial control networks, and at the same time comprehensively utilize various charts to intuitively assist network security analysis, and can achieve dynamic analysis and hidden danger prevention and control.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a semi-passive industrial control network security analysis tool and method based on a Bayesian attack graph. Background technique [0002] The industrial control system is composed of various automation control components and process control components for collecting and monitoring real-time data. It is a business process control system that ensures the automatic operation, process control and monitoring of industrial technical facilities. Its core components include data collection and Supervisory control system (SCADA), distributed control system (DCS), programmable logic controller (PLC), remote terminal (RTU), intelligent electronic device (IED). Explanation of related terms: ICS (Industrial Control System): Industrial Control System; AG (Attack Graph): Attack Graph; BAG (Bayesian Attack Graphs): Bayesian Attack Graph; CVSS (Common Vulnerability Scoring System): Com...

AI Technical Summary

Problems solved by technology

[0004] In view of the above-mentioned existing technologies, the existing industrial control network security analysis tools currently have problems such as lack of compatible design for industrial control networks, poor security analysis effect, and failure to prevent and control hidden dangers.

Images