Quantitative evaluation method and system for industrial control network-oriented multi-mode attack mode on state of industrial control system

Abstract

The present invention relates to a method and system for quantitatively evaluating the impact of multi-mode attack methods on industrial control systems on the state of industrial control systems. Data segmentation point; (2) Clustering state characteristics; (3) Constructing state transition probability map; (4) Quantitatively evaluating the impact of system state based on abnormal characteristics and damage degree indicators. The present invention is oriented to a variety of industrial control network attack strategies, and takes the abnormal state characteristics as the main index to quantitatively evaluate the actual state changes of the system during the attack progress stage and the attack end stage, and solves the problem that it is difficult to accurately evaluate the influence of various attack strategies on the system state. The present invention proposes a formula for assessing the impact of attack strategies on system states, associates, evaluates and analyzes state abnormal features and threat damage degrees, and obtains an evaluation result that is relatively consistent with the actual state impact.

Description

technical field [0001] The invention relates to a method and system for quantitatively evaluating the influence of an industrial control network-oriented multi-mode attack mode on the state of an industrial control system, and belongs to the technical field of information security. Background technique [0002] Components such as engineer station, human-machine interface (HMI), control equipment, sensors, and controlled equipment in the industrial control network, as well as the communication network between them, all have the possibility of being attacked. Scholars started early in the research work on the impact of physical attacks, man-in-the-middle attacks, denial-of-service attacks, and covert attacks on industrial control networks. In 2009, Yu established a method to describe the attack threat model. Using the attack of the command u and the attack of the sensor parameter y, the way of performing denial of service attack and man-in-the-middle attack is verified by anal...

AI Technical Summary

Problems solved by technology

[0004] The research on attack impact assessment has important theoretical value and practical significance for identifying attack intentions. The research work of the above scholars has promoted the development of equipment state impact analysis under semantic attacks, but the research in the specific security attack and defense shooting range environment is still relatively rare. See

[0005] However, under the attack of the industrial control network, the equipment is in multiple stages of "normal operation → attack → attack end", and the characteristics of state changes in each stage are diverse. The existing research on the impact of attacks lacks the understanding of the various stages of the system under different attack strategies. Evaluation and analysis of state characteristic changes

In the existing research on the impact of semantic attacks, there is a lack of evaluation and analysis of the relationship between abnormal state characteristics and threat damage

Images