Vulnerability discovery method and device for private protocol of control equipment

Abstract

The invention relates to a vulnerability discovery method and device for a control equipment private protocol, electronic equipment and a storage medium. The vulnerability discovery method for the control equipment private protocol comprises the following steps: sniffing communication flow generated in a process of communicating with industrial control equipment through engineering software; generating an initial test tuple based on the communication traffic, marking a part of messages of the initial test tuple as seeds, and generating a test case based on the seeds; guiding the state of the industrial control equipment and verifying the legality of network connection based on the initial test tuple; and testing the industrial control equipment based on the test case, and discovering abnormity of the industrial control equipment by monitoring an output signal waveform and a network state of the industrial control equipment. According to the method provided by the invention, the state of the control equipment is guided by using the message sequence, and the test case is generated, so that security vulnerabilities of the industrial control equipment can be effectively found.

Description

technical field [0001] The invention relates to the technical fields of network protocol implementation security, Internet of Things / industrial control equipment security and security testing, and in particular to a vulnerability discovery method, device, electronic equipment and storage medium for private protocols of control equipment. Background technique [0002] With the development of the Industrial Internet, information technology and operational technology tend to converge. The application of fusion technology breaks the original closedness and isolation of industrial control systems, which not only improves production efficiency, but also increases the probability of industrial control equipment facing network threats. Moreover, the purpose of attacks on industrial control systems is often to have an impact on the physical world, so control devices are more likely to become the target of attackers, who trigger vulnerabilities in devices through network protocol comm...

AI Technical Summary

Problems solved by technology

[0004] The present invention proposes a fuzzy testing vulnerability mining method based on message-driven and information-physical integrated monitoring for industrial control equipment, and solves the vulnerability mining efficiency caused by the unknown grammar, semantics, timing sequence and unknown device function dependencies of traditional vulnerability mining tools. Low-level problems, as well as the missing report problem caused by the fact that embedded devices do not have a GUI and cannot obtain device abnormal information, achieve the purpose of effectively discovering security defects in the implementation of private protocols for industrial control devices

Images