CN112114579B - A security measurement method for industrial control systems based on attack graph - Google Patents

Abstract

The invention relates to an industrial control system safety measurement method based on an attack graph, which comprises the following steps: acquiring topology structure information of an industrial control network, detecting equipment of a specific industrial control system, grasping equipment information in the industrial control network, and analyzing the association condition of the equipment; aiming at the detection result of equipment in the industrial control network, collecting equipment vulnerability information; according to the topological structure and the equipment vulnerability information, storing the format in a graphical format by a method based on a graph database, and generating a system attack graph by representing the graph structure by adopting nodes and relations; according to the generated system attack graph, network security measurement is carried out on a specific industrial control system according to three layers of vulnerability node measurement, equipment node measurement and system security measurement, and an attack path is analyzed. The method can find potential threat to the greatest extent, greatly shorten analysis period of safety measurement of the industrial control system, improve measurement efficiency and lay foundation for protection work of the industrial control system.

Description

A security measurement method for industrial control systems based on attack graphs

Technical Field

The invention relates to an industrial control system security measurement method based on an attack graph, and belongs to the technical field of network security.

Background Art

In recent years, industrial control systems have gradually developed towards informatization, which not only introduced diversified methods in the Internet, but also brought multiple attack threats to industrial control systems. Highly informatized industrial control systems need to face changes in the network environment and the potential impact of network components on the system. In view of the complexity of the operating environment of industrial control systems and the diversification of attack methods, a security measurement method for industrial control systems based on attack graphs is proposed. By integrating vulnerability and topology information, the potential attack paths of industrial control systems are displayed, and the security measurement process is visualized, which provides data support for subsequent system security analysis and protects mission-critical assets from potential threat sources.

For example, Chinese patent document CN110533754A provides an interactive attack graph display system and display method based on a large-scale industrial control network. The display system includes a json file construction module, a network topology generation module, a scene roaming processing module, an attack graph generation module and an interactive event processing module; the method starts from the attack target and reversely generates the attack graph, which greatly reduces the complexity and usability of the attack graph. The attack graph display system adopts an interactive form, allowing users to switch attack targets by clicking, and generate real-time key attack paths based on the determined targets, which greatly improves the visual management of the attack graph. It is convenient for security operation and maintenance personnel and security analysts to conduct network security analysis and evaluation, and can effectively help network security incident handlers to identify network attack paths early and defend key points. Chinese patent document CN108156114A provides a method and device for determining key nodes of a network attack graph of an electric power information-physical system, the method comprising: respectively obtaining at least one characteristic value of all nodes in the attack graph; respectively determining the weight of the characteristic value; and determining the key node from all the nodes according to the at least one characteristic value and the weight. By obtaining at least one characteristic value of all nodes in the attack graph, the importance of each node can be quantified; by determining the weight of each characteristic value, the characteristic value can be weighed; finally, according to the characteristic value and the corresponding weight, the key node is determined from all nodes, and all nodes are comprehensively considered, thereby realizing the identification of the key nodes of the system attack graph from multiple aspects and dimensions, and solving the problem of uncertainty in the focus of attack graph security protection. Chinese patent document CN108629474A discloses a process safety assessment method based on an attack graph model, which includes the following steps: designing security nodes according to the security attributes of the security control system; forming a process plan with the designed nodes according to the business process logic; realizing the design of the process plan by establishing a tree diagram; evaluating and modeling the designed process plan, and generating an evaluation conclusion through evaluation calculation; the process plan evaluation includes establishing a process safety evaluation system, a reliability evaluation system and an operation efficiency evaluation system, and based on the evaluation values of the indicators of these three evaluation systems, a comprehensive evaluation result of the system is given through a comprehensive scoring model; according to the importance, feasibility and complexity parameter level of the security weak nodes, an optimization strategy for the current process plan is given. This method solves the uncertainty caused by human intervention and improves the accuracy, reliability and efficiency of safety assessment results.

At present, there are few security measurement methods for industrial control systems, lack of system-wide security measurement solutions, and they cannot consider the vulnerability relationship between system devices. Due to the complex topology of industrial control systems and the difficulty in selecting and quantifying security indicators in measurement, current security measurement solutions are mostly based on qualitative analysis. Therefore, in order to solve the global measurement of security quantification of industrial control systems, it is urgent to design a security measurement method for global measurement of industrial control systems.

Summary of the invention

In view of the shortcomings of the prior art, the present invention provides a security measurement method based on an industrial control system attack graph. The attack graph uses a graph structure to represent detailed information on the attack process of the industrial control system. The method comprehensively considers the special hierarchical structure of the industrial control system equipment and its vulnerabilities and dependencies, establishes an association model between equipment and vulnerabilities, and between equipment, and displays possible attack paths. Finally, the method combines the attack path with the various indicators in the attack graph, and can achieve global security measurement of the industrial control system.

Terminology explanation:

1. CVE-NVD (Common Vulnerabilities and Exposures-National Vulnerability Database), Common Vulnerabilities and Risk Exposures-National Vulnerability Database.

2. CNNVD (China National Vulnerability Database of Information Security), China National Information Security Vulnerability Database.

3. ICS (Industrial control system) Vulnerability Database, industrial control system vulnerability database.

4. CWE (Common Weakness Enumeration), common weakness enumeration.

5. CAPEC (Common Attack Pattern Enumeration and Classification), available attack pattern enumeration and classification.

6. Exploitability: It indicates the probability that this vulnerability can be successfully exploited to achieve the attack effect.

7. Vulnerability hazard, which indicates the severity of the impact caused by successful exploitation of the vulnerability.

The technical solution of the present invention is as follows:

A security measurement method for industrial control systems based on attack graphs includes the following steps:

Step 1: Obtain the topological structure information of the industrial control network, detect the equipment of a specific industrial control system, grasp the equipment information in the industrial control network, and analyze the equipment association situation;

Step 2: Based on the detection results of the devices in the industrial control network, collect device vulnerability information;

Step 3: Based on the topological structure and device vulnerability information, the graph database method is used to store the information in a graphical format, and the graph structure is represented by nodes and relationships to generate a system attack graph;

Step 4: Based on the generated system attack graph, network security measurement is performed on the specific industrial control system at three levels: vulnerability node measurement, device node measurement, and system security measurement, and the attack path is analyzed.

Preferably, in step one, the GRASSMARLIN tool is used to obtain the industrial control network topology information.

Preferably, in step one, the industrial control network topology information is obtained, including the topology planning in the system design document, the system configuration, and the access control rules of the security equipment; according to the system design document and the access control rules of the security equipment, the connection relationship between the system equipment is read and extracted to restore the system topology.

Preferably, in step one, detecting the equipment of a specific industrial control system means using the GRASSMARLIN tool to monitor the industrial control system topology in real time to detect equipment newly added to the industrial control system, and the GRASSMARLIN tool uses a passive detection method to collect information on the detection system, thereby reducing the impact of the detection process on the working status of the equipment in the industrial control system.

Preferably, in step one, grasping the device information within the industrial control network refers to reading the device information in the system design documents and system configuration files, extracting the device type, device model, and system version as the data basis for subsequent acquisition of device vulnerability information.

Preferably, in step one, analyzing the device association situation refers to formatting the association relationship between devices based on the system topology information obtained from the system design document, system configuration file and access control rules of the security device, and uniformly defining the connection relationship between devices as link, A link B means that device A has a link to device B, A can access B, and link is a directed relationship.

Preferably, during the process of real-time monitoring of the industrial control system topology by the GRASSMARLIN tool, its detection results are stored in XML format. The GRASSMARLIN tool detection results are read regularly at a low frequency, and relationships are extracted for updated devices. The newly added devices are added to the system, and the system devices that interact with the new devices are updated. The connection relationship between the source IP and the destination IP in the same group is simplified, and redundant data is removed to achieve dynamic acquisition of the system topology. At the same time, the topological data is sorted in the order of detection for the original data and the updated data.

Preferably, in step 2, collecting device vulnerability information includes building a vulnerability information database and acquiring device vulnerabilities;

The construction of vulnerability information database includes vulnerability information collection and vulnerability information processing; vulnerability information collection is based on CVE-NVD vulnerability database, CNNVD and ICS Vulnerability Database as extended security database, CWE and CAPEC as vulnerability association information database, to build security knowledge base, and store the collected vulnerability information in MySQL database; vulnerability information processing is based on CNNVD and CVE vulnerability knowledge database, matching and associating all vulnerability information imported into MySQL database, introducing CWE as the basis for weakness description, weakness classification and exploitability judgment, and combining with CAPEC to describe the premise, technical reserve, method and consequences of exploiting vulnerabilities;

Device vulnerability acquisition uses a scanning tool to scan system devices for vulnerabilities. According to the acquired system device information, the scanning tool is configured to complete the scanning of device vulnerability information. Then, based on the device vulnerability information obtained from the scan, the device and the vulnerability are associated. A device can be associated with one or more vulnerabilities. The connection relationship between the device and the vulnerability is defined as has_vul_at. DEVICE1 has_vul_at VUL1 indicates that device 1 has a vulnerability numbered VUL1. The device vulnerability information is matched with the information in the vulnerability information library. For each vulnerability, an atomic attack template of "CNNVD description-CVE vulnerability number-CWE weakness report-CAPEC attack method-CVSS score" can be obtained to provide input data for the generation of subsequent attack graphs.

Preferably, in step 3, the nodes in the attack graph include device nodes and vulnerability nodes;

The device node information includes the service information, open port information and IP information where the device vulnerability is located. The device node information is the attribute of the device node. The device node information is described by a five-tuple, namely, the device IP, device name, the service with the vulnerability, the service protocol, and the service port.

Vulnerability node information includes the CVE\CNNVD number, CWE classification, privilege escalation capability identification and CVSS score in the atomic attack rule. Vulnerability node information is integrated as a node attribute on the vulnerability node identified by the vulnerability ID. Vulnerability node information is described using a four-tuple, namely vulnerability ID, vulnerability number, vulnerability type and vulnerability score.

According to the results of network topology analysis and vulnerability information collection, the data is preprocessed and summarized into device information table, vulnerability information table, and device relationship table as the input of the attack graph generation algorithm.

Preferably, in step three, a system attack graph is generated based on a Neo4j graph database, and the property graph model is followed to store and manage data. The nodes in the attack graph are used to represent entities, and the relationships are used to represent the connections between entities. The node attributes of the attack graph are filled with the device information table and the vulnerability information table, and the node relationships are filled with the device relationship table. The starting node and the target node are selected, and the attack graph is generated after multiple traversals.

Preferably, in step 4, the vulnerability node measurement quantifies the exploitability of the vulnerability node and the vulnerability hazard according to the scanned device vulnerability information; the exploitability of the vulnerability node is defined by the "attack possibility" field in the CAPEC library, and the attack possibility {low, medium, high} is quantified as {0.3, 0.6, 0.9}, a low score indicates a low possibility of attack, and a high score indicates a high possibility of attack; the hazard score of the vulnerability node adopts the vulnerability assessment score of the Common Vulnerability Scoring System CVSS, with a full score of 10 points, the higher the score, the greater the vulnerability hazard, and the lower the score, the smaller the vulnerability hazard.

Preferably, in step 4, the device node metric is quantified according to the probability of the device node being attacked and the device node risk score;

a. Probability of device nodes being attacked

For each vulnerable node connected to a device node, the attack probability of the device node is calculated based on its availability, as shown in Formula I:

Among them, U _self represents the attack probability of the device node, _ui represents the availability of the i-th vulnerable node connected to the device node, and k represents the number of all vulnerable nodes connected to the device node. The more vulnerable nodes connected to the device node, the higher the attack probability of the device node.

b. Device node risk score

Based on the availability of the connected vulnerable nodes, weighted hazard calculation is performed on the vulnerable nodes to obtain the risk score of the device node, as shown in Formula II:

Among them, R _self represents the risk score of the device node, _ui and u _j represent the availability of the i-th and j-th vulnerable nodes connected to the device node, and _ri represents the vulnerability hazard of the i-th vulnerable node connected to the device node.

Preferably, in step 4, the system security metric includes a starting node metric and a non-starting node metric;

a. Starting node measurement

Since the starting node has obtained the permission, it is not under attack, so the attack probability of the starting device node is 1 by default, indicating that all permissions of the device are obtained. Since the starting node has no forward node and the in-degree is 0, the danger score of the starting node is equal to the danger score of the node itself;

b. Non-starting node metrics

When considering the vulnerable nodes connected to the non-starting node, the non-starting node also needs to combine the attack probability and device risk score of the upper-layer device nodes to calculate the cumulative attack probability and device risk score of the upper-layer device nodes and the device nodes of the current layer. The system security metric is calculated based on the risk scores of the multi-layer accumulated device nodes.

The attack probability of non-starting nodes is calculated as follows:

Among them, d _i represents the node in-degree, U _m represents the attack probability of the mth upper-layer node connected to the device node; this measurement method takes into account the node in-degree and the impact of the upper-layer node attack probability on the current-layer node. The larger the node in-degree, the greater the probability of the node being attacked; the greater the upper-layer node attack probability, the greater the probability of the current-layer node being attacked;

The risk score of non-starting nodes is calculated as shown in Formula IV:

Wherein, U _m and _Un represent the attack probability of the mth and nth upper nodes connected to the device node, and R _m represents the risk score of the mth upper node connected to the device node;

The calculation of the danger score of non-starting nodes takes into account the impact of the probability of the upper-level nodes being attacked on the nodes at this level, and at the same time accumulates the danger scores of the upper-level nodes. The larger the node in-degree, the greater the node danger score; the greater the probability of the upper-level node being attacked, the greater the danger score of the node at this level; the greater the danger score of the upper node, the greater the danger score of the node at this level. Finally, the danger score R _dest of the target node is obtained through cumulative calculation of multiple layers of attack paths.

Preferably, in step 4, the attack path includes a nested path and a parallel path; the key attack path is quantitatively analyzed in combination with the system security metric value, and the asset value index is introduced in the analysis process for measurement. The asset value is determined by the node in-degree and the asset importance. The asset importance index is divided into ten levels from 1 to 10 for assets, 10 for very important, and 1 for very unimportant; at the same time, according to the node in-degree appearing in the current attack graph, the highest in-degree is taken as the standard, and the remaining in-degrees are normalized. The in-degree of the starting node and the target node is defaulted to 1, and no weight reduction is performed. Finally, the asset value is obtained by the product of the asset importance and the in-degree, as shown in Formula V:

P _value =P _significance *d _io (Ⅴ)

Among them, P _value represents the asset value, P _significance represents the asset importance, and d _io represents the normalized node in-degree;

a. Nested Path Analysis

The nodes in the path set of the nested path do not include the common starting node. For this case, the key path is selected and calculated as follows:

Among them, Path _sign is the path critical index, _Uj represents the probability of the jth device node in the path set being attacked, _Ri represents the risk score of the i-th device node in the path set, and _Pvaluei represents the asset value of the i-th device node in the path set; the critical path of the nested path is mainly calculated based on the number of attack hops. Generally, the path with fewer attack hops is the critical path. Only when the attack rate and risk score of the intermediate hop node are large, the path with more attack hops may become the critical path;

b. Parallel Path Analysis

The path set of the parallel attack path is represented by N parallel nodes excluding the common starting node and ending node. The critical path for this case is selected and calculated as follows:

Path _sign ＝max{U _i *R _i *P _valuei }i＝(1, 2,...k) (Ⅶ)

U _i represents the probability of attack of the i-th device node in the path set, R _i represents the risk score of the i-th device node in the path set, and P _valuei represents the asset value of the i-th device node in the path set; finally, the selection of the critical path is obtained by comparing the critical indexes of N parallel paths;

Based on the analysis results of nested paths and parallel paths, the importance of multiple paths is calculated through quantitative indicators to obtain the key attack paths.

A server, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned industrial control system security measurement method based on the attack graph.

A computer-readable medium stores a computer program, wherein the computer program implements the above-mentioned industrial control system security measurement method based on attack graph when executed by a processor.

Technical features and beneficial effects of the present invention:

1. The present invention takes CVE-NVD as the main body, CNNVD and ICS Vulnerability Database as the extended security library, and CWE and CAPEC as the vulnerability association information library to jointly build an overall security knowledge base. At the same time, combined with the scanning results of multiple tools, the isolated data is screened, associated, and integrated to generate an attack graph suitable for industrial control systems, and the system security is measured in layers to provide decision support and situational awareness. According to the vulnerability dependency, this method associates network threats with industrial control system equipment, discovers potential threats to the greatest extent, greatly shortens the analysis cycle of industrial control system security measurement, improves the efficiency of measurement, and lays the foundation for the protection of industrial control systems.

2. This method proposes a security measurement method for industrial control systems based on attack graphs. By using technologies such as asset detection, vulnerability scanning, vulnerability exploitation, attack graph generation based on graph data, and hierarchical security measurement, it can visualize the system attack path and measure the security of the system under test, providing protection for the safe operation of industrial control systems. It can cover a variety of vulnerabilities and industrial control equipment types; it can generate attack graphs for any starting point and attack target; and it can provide data support for further system analysis. The practical scope includes supporting the generation of attack graphs for any attack starting point and attack target in industrial control systems, as well as measuring the security of industrial control systems, providing data support for security analysis of industrial control systems, and has a very broad application prospect.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a diagram of the architecture of the attack graph-based security measurement method;

Figure 2 is a schematic diagram of the topological structure of an industrial control system;

FIG3 is a schematic diagram of vulnerability information association of an attack template;

Figure 4 is a flow chart of the attack graph generation algorithm;

Figure 5 is a schematic diagram of attack graph generation;

FIG6 is a schematic diagram of an attack path, wherein (a) is a schematic diagram of a nested attack path, and (b) is a schematic diagram of a parallel attack path;

DETAILED DESCRIPTION

The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

Embodiment 1:

This embodiment provides an industrial control system security measurement method based on an attack graph, which includes the following four steps. The overall architecture of this method is shown in FIG1 :

Step 1: Obtain the topological structure information of the industrial control network, detect the equipment of a specific industrial control system (i.e., the target industrial control system to be security-measured), grasp the equipment information in the industrial control network, and analyze the equipment association;

The first step is the foundation, which mainly obtains the target industrial control system's equipment's own information and related information in the entire industrial control network;

Step 2: Based on the detection results of the devices in the industrial control network, i.e., the device information and related information of the specific industrial control system in step 1, collect the device vulnerability information;

Step 3: Based on the topological structure and device vulnerability information, the graph database method is used to store the information in a graphical format, and the graph structure is represented by nodes and relationships to generate a system attack graph;

Step 4: Based on the generated system attack graph, network security measurement is performed on the specific industrial control system at three levels: vulnerability node measurement, device node measurement, and system security measurement, and the attack path is analyzed.

Specifically, in step 1, the GRASSMARLIN tool is used to obtain the industrial control network topology structure. The obtained industrial control network topology structure information includes the topology planning, system configuration and access control rules of security devices in the system design documents; according to the system design documents and the access control rules of security devices, the connection relationship between system devices is read and extracted to restore the system topology structure. At the same time, the device information in the system design documents and system configuration files is read, and the device type, device model and system version are extracted as the data basis for obtaining device vulnerability information.

In addition, in view of the vulnerability and real-time characteristics of industrial control systems, the GRASSMARLIN tool is used to monitor the industrial control system topology in real time to detect new devices added to the industrial control system (the ultimate goal is to achieve dynamic updates of the system attack graph), and the GRASSMARLIN tool uses a passive detection method to collect information on the detection system, reducing the impact of the detection process on the working status of the equipment in the industrial control system. That is, the topology information collection shown in Figure 1.

When the GRASSMARLIN tool performs real-time monitoring of the industrial control system topology, its detection results are stored in XML format. The detection results of the GRASSMARLIN tool are read at a low frequency and regularly (the specific situation depends on the particularity of each system and is set by the technical staff). The relationship of the updated equipment is extracted, the newly added equipment is added to the system, and the system equipment that has information interaction with the new equipment is updated. The connection relationship between the source IP and the destination IP in the same group is simplified, and redundant data is removed to realize dynamic acquisition of the system topology. At the same time, the topological data of the original data and the updated data are sorted according to the order of detection.

Mastering the device information within the industrial control network means reading the device information in the system design documents and system configuration files, extracting the device type, device model, and system version as the data basis for subsequent device vulnerability information acquisition.

Analyzing device associations means formatting the associations between devices based on system topology information obtained from system design documents, system configuration files, and access control rules of security devices. The connection relationships between devices are uniformly defined as links. A link B means that device A has a link to device B, and A can access B. Link is a directed relationship.

In step 2, the device vulnerability information is collected, including the construction of the vulnerability information database and the acquisition of device vulnerabilities;

The construction of vulnerability information database includes vulnerability information collection and vulnerability information processing. Vulnerability information collection is based on CVE-NVD vulnerability database, CNNVD and ICS Vulnerability Database are extended security databases, CWE and CAPEC are vulnerability association information databases, to build a security knowledge base, and store the collected vulnerability information (vulnerability information in the vulnerability database) in MySQL database; vulnerability information processing is based on CNNVD and CVE vulnerability knowledge databases, matching and associating all vulnerability information imported into the vulnerability information database (i.e. MySQL database), introducing CWE as the basis for weakness description, weakness classification and exploitability judgment, and combining with CAPEC to describe the premise, technical reserves, methods and consequences of exploiting vulnerabilities;

The collected vulnerability information content items include: vulnerability name, CNNVD number, basic score, CVE number, hazard level, vulnerability type, vulnerability release time, vulnerability update time, threat type, manufacturer, vulnerability description, solution, affected entity, patch, CWE number, CWE name, weakness description, other related weaknesses, weakness introduction method, weakness application impact, related attack method, attack possibility, attack field, attack mechanism, prerequisites, and required skills.

The vulnerability information association diagram of the attack template is shown in Figure 3. Based on the CVE-NVD vulnerability knowledge base, the vulnerability name, CNNVD number, CVE number, hazard level, vulnerability type, vulnerability release time, vulnerability update time, threat type, manufacturer, vulnerability description, solution, affected entity, and patch are filled in according to the information in the CNNVD vulnerability details page. Each CNNVD vulnerability number corresponds to a CVE number, and the CVE number can be associated with the vulnerability information in the CVE vulnerability page. The CVE vulnerability page will provide the associated CWE number, which is linked to the CWE security event library. Common Weakness Enumeration CWE classifies weaknesses and provides a description of the weakness for each CWE number. Based on the acquired weaknesses, the remaining related weaknesses, the way to introduce the weaknesses, the impact of the weaknesses on the application, and the related attack methods are described, and the vulnerability exploitation conditions, exploitation methods, and attack results are filled in with the vulnerability as the core. At the same time, the multiple CAPEC numbers contained in the relevant attack methods are used to complete the attack prerequisites in the attack template and the skills required for the attack based on the attack information of the attack possibility, attack field, attack mechanism, prerequisites, and required skills provided on the CAPEC page. In addition, in order to provide a feasibility analysis and severity judgment of a specific vulnerability, the CVE number can be associated with CVSS, which provides a severity rating and risk score for each vulnerability. The information integration and association of multiple vulnerability information repositories is completed.

Equipment vulnerability acquisition uses open source scanning tools (such as Nessus, OpenVAS, etc.) and customized scanning tools of industrial control manufacturers to scan system equipment for vulnerabilities. According to the acquired system equipment information, the scanning tool is configured to complete the scanning of equipment vulnerability information. Compared with traditional networks, industrial control systems face more stringent security requirements. When performing equipment vulnerability scanning, the vulnerability of industrial control equipment must be considered. In view of the sensitivity of industrial control systems, different scanning methods are adopted for vulnerability scanning of industrial control equipment and general Internet equipment according to different equipment types. For industrial control system equipment, vulnerability scanning is performed at a low frequency, while general Internet equipment is scanned at a high frequency. The multi-frequency scanning scheme can reduce the injection of detection data reporting, which will increase the network load and the risk of detection to industrial control equipment, while ensuring the real-time acquisition of equipment vulnerability information.

Then, according to the device vulnerability information obtained through scanning, the device and the vulnerability are associated. A device can be associated with one or more vulnerabilities. The connection relationship between the device and the vulnerability is defined as has_vul_at. DEVICE1 has_vul_atVUL1 indicates that the device 1 has a vulnerability numbered VUL1. The device vulnerability information is matched with the information in the vulnerability information library. Each vulnerability can obtain an atomic attack template of "CNNVD description-CVE vulnerability number-CWE weakness report-CAPEC attack method-CVSS score", which provides input data for the generation of subsequent attack graphs. As shown in Figure 3.

In step 3, the attack graph contains nodes and edges. The edges are attackable paths. The nodes in the attack graph include device nodes and vulnerability nodes.

The device node information includes the service information, open port information and IP information where the device vulnerability is located. The device node information is the attribute of the device node. The device node information is described by a five-tuple, namely, the device IP, device name, the service with the vulnerability, the service protocol, and the service port.

Vulnerability node information includes the CVE\CNNVD number, CWE classification, privilege escalation capability identification and CVSS score in the atomic attack rule. Vulnerability node information is integrated as a node attribute on the vulnerability node identified by the vulnerability ID. Vulnerability node information is described using a four-tuple, namely vulnerability ID, vulnerability number, vulnerability type and vulnerability score.

According to the results of network topology analysis and vulnerability information collection, the data is preprocessed and summarized into a device information table, a vulnerability information table, and a device relationship table as the input of the attack graph generation algorithm. As shown in the following table, in the device relationship table, "Y" represents that the devices have a connection relationship, and "-" represents that the devices do not have a connection relationship.

Table 1: Equipment information table

Table 2: Vulnerability information table

Table 3: Equipment relationship table

In step three, the system attack graph is generated based on the Neo4j graph database, which follows the property graph model to store and manage data. The nodes in the attack graph are used to represent entities, and the relationships are used to represent the connections between entities. The node attributes of the attack graph are filled with the device information table and the vulnerability information table, and the node relationships are filled with the device relationship table. The start node and the target node are selected, and the attack graph is generated after multiple traversals.

The data in the above three tables are used as the input of the attack graph generation algorithm. The algorithm flow chart is shown in Figure 4. First, import device information, vulnerability information, device relationships, and vulnerability matching into the Neo4j graph database. According to the atomic attack rule model, identify the vulnerability nodes that do not conform to the model exploitation and the device nodes that do not meet the attack conditions. Remove devices that are not on the attack target route and isolated vulnerability nodes. Finally, limit the attacker and target, return the information in the current graph database, and build an attack graph for the system.

Taking the industrial control system in Figure 5 as an example, the starting node is limited to the MES system host and the target node is PLC1, and an attack graph is generated, including 17 nodes and 19 edges. Since the MES system PC3 contains two exploitable vulnerabilities, this attack graph contains a total of 12 attack paths.

In step 4, network security measurement adopts a hierarchical measurement method to measure the industrial control network security according to the node type, namely vulnerability node measurement, device node measurement, and system security measurement. There are two types of additional attributes of vulnerability nodes: exploitability and vulnerability damage. The exploitability indicates the probability that this vulnerability can be successfully exploited to achieve the attack effect. The vulnerability damage indicates the severity of the impact caused by the successful exploitation of the vulnerability. There are also two types of additional attributes of device nodes: attack probability and device risk score. The attack probability is related to the exploitability of the vulnerability node connected to the device, indicating the probability of the device being successfully attacked. The device risk score is related to the exploitability and vulnerability damage of the vulnerability node connected to the device, indicating the degree of impact caused by the successful attack on the device.

The calculation for nodes is divided into two categories: starting nodes and non-starting nodes. The starting node only needs to consider the vulnerability nodes connected to the node; the non-starting node not only considers the vulnerability nodes connected to the node, but also combines the attack probability and device risk score of the upper-layer device nodes. The system security metric is calculated based on the risk scores of the multi-layer accumulated device nodes.

(1) Vulnerability node measurement quantifies the exploitability of vulnerability nodes and the vulnerability hazard based on the scanned device vulnerability information; the exploitability of vulnerability nodes is defined by the "attack probability" field in the CAPEC library, and the attack probability {low, medium, high} is quantified as {0.3, 0.6, 0.9}. A low score indicates a low possibility of attack, and a high score indicates a high possibility of attack; the hazard score of the vulnerability node adopts the vulnerability assessment score of the Common Vulnerability Scoring System (CVSS), with a full score of 10. The higher the score, the greater the vulnerability hazard, and the lower the score, the smaller the vulnerability hazard.

(2) The device node metric is quantified based on the probability of the device node being attacked and the device node risk score;

a. Probability of device nodes being attacked

For each vulnerable node connected to a device node, the attack probability of the device node is calculated based on its availability, as shown in Formula I:

Among them, U _self represents the attack probability of the device node, _ui represents the availability of the i-th vulnerable node connected to the device node, and k represents the number of all vulnerable nodes connected to the device node. The more vulnerable nodes connected to the device node, the higher the attack probability of the device node.

b. Device node risk score

Based on the availability of the connected vulnerable nodes, weighted hazard calculation is performed on the vulnerable nodes to obtain the risk score of the device node, as shown in Formula II:

Among them, R _self represents the risk score of the device node, _ui and u _j represent the availability of the i-th and j-th vulnerable nodes connected to the device node, and _ri represents the vulnerability hazard of the i-th vulnerable node connected to the device node.

(3) System security metrics include starting node metrics and non-starting node metrics;

a. Starting node measurement

Since the starting node has obtained the permission, it is not under attack, so the attack probability of the starting device node defaults to 1, indicating that all permissions of the device are obtained. Since the starting node has no forward node and the in-degree is 0, the danger score of the starting node is equal to the danger score of the node itself.

b. Non-starting node metrics

When considering the vulnerable nodes connected to the non-starting node, the non-starting node also needs to combine the attack probability and device risk score of the upper-layer device nodes to calculate the cumulative attack probability and device risk score of the upper-layer device nodes and the device nodes of the current layer. The system security metric is calculated based on the risk scores of the multi-layer accumulated device nodes.

The attack probability of non-starting nodes is calculated as follows:

Among them, d _i represents the node in-degree, U _m represents the attack probability of the mth upper-layer node connected to the device node; this measurement method takes into account the node in-degree and the impact of the upper-layer node attack probability on the current-layer node. The larger the node in-degree, the greater the probability of the node being attacked; the greater the upper-layer node attack probability, the greater the probability of the current-layer node being attacked;

The risk score of non-starting nodes is calculated as shown in Formula IV:

Wherein, U _m and _Un represent the attack probability of the mth and nth upper nodes connected to the device node, and R _m represents the risk score of the mth upper node connected to the device node;

The danger score measurement method for non-starting nodes takes into account the impact of the probability of upper-level nodes being attacked on the nodes at this level, and at the same time accumulates the danger scores of the upper-level nodes. The larger the node in-degree, the greater the node danger score; the greater the probability of upper-level nodes being attacked, the greater the danger score of the nodes at this level; the greater the danger score of the upper node, the greater the danger score of the nodes at this level. Finally, the danger score R _dest of the target node is obtained through cumulative calculation of multiple layers of attack paths.

In step 4, the attack path includes nested paths and parallel paths; the key attack paths are quantitatively analyzed in combination with the system security metric value. The asset value index is introduced in the analysis process for measurement. The asset value is determined by the node in-degree and the asset importance. The asset importance index is divided into ten levels from 1 to 10 (the asset importance index needs to be determined based on expert experience), 10 is very important, and 1 is very unimportant; at the same time, according to the node in-degree appearing in the current attack graph, the highest in-degree is taken as the standard, and the remaining in-degrees are normalized. The in-degree of the starting node and the target node is 1 by default, and no weight reduction is performed. Taking the attack graph shown in Figure 6 as an example, the in-degree = {2, 5}, after normalization, the node with an in-degree of 5 becomes 1, and the node with an in-degree of 2 becomes 0.4. Finally, the asset value is obtained by the product of the asset importance and the in-degree, as shown in Formula V:

P _value =P _significance *d _io (Ⅴ)

Among them, P _value represents the asset value, P _significance represents the asset importance, and d _io represents the normalized node in-degree;

Combined with the above indicators, the key attack paths in the attack graph are analyzed. There are two situations in which branch paths are generated in the attack path: one is nested path analysis and the other is parallel path analysis, as shown in Figure 6.

a. Nested Path Analysis

As shown in Figure 6 (a), the attack path of MES PC1-->MES PC2-->MES PC3 includes the path of MESPC1-->MES PC3. The nodes in the path set of the nested path do not include the common starting node: Path1 = {MESPC2}, Path2 = {MES PC2, MES PC3}. For this case, the key path is selected and calculated as follows:

Among them, Path _sign is the path critical index, _Uj represents the probability of the jth device node in the path set being attacked, _Ri represents the risk score of the ith device node in the path set, and _Pvaluei represents the asset value of the ith device node in the path set; the critical path of the nested path is mainly calculated based on the number of attack hops. Generally, the path with fewer attack hops is the critical path. Only when the attack rate and risk score of the intermediate hop node are both large, the path with more attack hops may become the critical path. This depends on different target industrial control systems and is judged by technicians based on long-term work experience; taking Figure 6 (a) as an example, according to actual experience, the asset importance of MES PC2 and MES PC3 is defined as 6, and their in-degree normalization results are both 0.4. Path1 _sign = 0.9*9.9*2.4 = 21.384, Path2 _sign = 0.3*0.9*9.9*2.4+0.3*6.9*2.4 = 11.3832. Therefore, the key path in the nested attack path is Path1, that is, the MES PC1-->MES PC3 path.

b. Parallel Path Analysis

As shown in Figure 6 (b), the attack path of database server -> PLC1 includes three parallel attack paths: database server -> operator station -> PLC1, database server -> engineer station -> PLC1, and database server -> SCADA system -> PLC1. The path set of parallel attack paths is represented by three parallel nodes excluding the common starting node and ending node. Path {operator station, engineer station, SCADA system} selects the critical path for this case and is calculated as follows:

Path _sign ＝max{U _i *R _i *P _valuei }i＝(1, 2,...k) (Ⅶ)

U _i represents the probability of attack of the i-th device node in the path set, R _i represents the risk score of the i-th device node in the path set, and P _valuei represents the asset value of the i-th device node in the path set; finally, the selection of the critical path is obtained by comparing the critical indexes of the three parallel paths;

Taking Figure 6 (b) as an example, based on actual experience, the asset importance of the operator station is defined as 8, the asset importance of the engineer station is defined as 7, and the asset importance of the SCADA system is defined as 9, and the normalized results of their in-degrees are all 0.4. Path _sign = max{0.6*7.8*3.2, 0.8*9.8*2.8, 0.9*6.9*3.6} = max{14.976, 21.952, 22.356}. Therefore, the key path in the parallel attack path is Path 3, that is, the database server-->SCADA system-->PLC1 path.

Based on the analysis results of nested paths and parallel paths, it can be seen that a key path of the attack graph is MES PC1-->MES PC3-->Database server-->SCADA system-->PLC1. The importance of multiple paths is calculated through quantitative indicators to obtain the key attack path. The key attack path of the system that comprehensively considers asset value, attack possibility, and vulnerability hazards can reflect the security status of the key parts of the system. At the same time, the system's vulnerabilities can be accurately located based on the path score, device score, and vulnerability score. In addition, based on the vulnerability details provided in the vulnerability library, it is possible to quickly understand the vulnerability attributes and find solutions, providing data support for the security protection of industrial control systems.

Embodiment 2:

A server, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

When the one or more programs are executed by the one or more processors, the one or more processors implement the industrial control system security measurement method based on the attack graph described in Example 1.

Embodiment 3:

A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the industrial control system security measurement method based on an attack graph as described in Example 1.

The above description is only a specific implementation mode of the present invention, and the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims (9)

1. An industrial control system safety measurement method based on an attack graph is characterized by comprising the following steps:

step one, acquiring topology structure information of an industrial control network, detecting equipment of a specific industrial control system, grasping equipment information in the industrial control network, and analyzing the association condition of the equipment;

step two, collecting equipment vulnerability information aiming at the detection result of equipment in the industrial control network;

thirdly, storing a format in a graphical format by a method based on a graph database according to the topological structure and the equipment vulnerability information, and generating a system attack graph by representing the graph structure by adopting nodes and relations;

fourthly, according to the generated system attack graph, carrying out network security measurement on a specific industrial control system according to three layers of vulnerability node measurement, equipment node measurement and system security measurement, and analyzing an attack path; the equipment node measurement is quantified according to the attack probability of the equipment node and the equipment node danger score;

a. Probability of device node being attacked

Aiming at the vulnerability node connected with each equipment node, calculating the attack probability of the equipment node according to the availability ratio of the vulnerability node, wherein the attack probability is as shown in the formula I:

wherein U is _self Representing the probability of being attacked by the node of the device, u _i The method comprises the steps that the availability of an ith vulnerability node connected with the equipment node is represented, k represents the number of all vulnerability nodes connected with the equipment node, and the more the number of vulnerability nodes connected with the equipment node is, the higher the attack probability of the equipment node is;

b. device node risk score

And (3) carrying out weighted hazard calculation on the vulnerability nodes based on the availability of the connected vulnerability nodes to obtain the hazard score of the equipment nodes, wherein the hazard score is as shown in a formula II:

wherein R is _self Representing the risk score of the equipment node, u _i 、u _j Indicating the availability of the ith and jth vulnerability nodes connected with the equipment node, and r _i Represents the vulnerability of the ith vulnerability node connected to the device node.

2. The attack graph-based industrial control system security measurement method according to claim 1, wherein in the first step, the obtaining of the industrial control network topology information includes topology planning, system configuration and access control rules of the security device in a system design document; and reading the connection relation between the system devices and extracting according to the system design document and the access control rule of the safety device so as to restore the system topology structure.

3. The attack graph-based industrial control system security measurement method according to claim 1, wherein in the second step, collecting the device vulnerability information comprises vulnerability information base construction and device vulnerability acquisition;

the loophole information base construction comprises loophole information acquisition and loophole information processing; the vulnerability information collection takes a CVE-NVD vulnerability database as a main body, CNNVD and ICS Vulnerability Database are expansion security libraries, CWE and CAPEC are vulnerability association information libraries to construct a security knowledge base, and the collected vulnerability information is stored in a MySQL database; the vulnerability information processing takes CNNVD and CVE vulnerability knowledge base as main bodies, matches and associates all vulnerability information imported into MySQL database, introduces CWE as the basis of vulnerability description and vulnerability classification and availability discrimination, and combines CAPEC to describe the premise, technical reserve, mode and caused result of attack by utilizing vulnerability;

the device vulnerability acquisition adopts a scanning tool to scan the vulnerability of the system device, and the scanning tool is configured according to the acquired system device information to complete the scanning of the device vulnerability information; then according to the DEVICE vulnerability information obtained by scanning, carrying out association representation on the DEVICE and the vulnerability, wherein one DEVICE can be associated with one or more vulnerabilities, the connection relation between the DEVICE and the vulnerability is defined as has_vul_at, and the DEVICE1 has_vul_at_VUL1 represents that the DEVICE1 has the vulnerability with the number VUL 1; matching the device vulnerability information with information in a vulnerability information base, and obtaining an atomic attack template of CNNVD description-CVE vulnerability number-CWE vulnerability report-CAPEC attack method-CVSS score by each vulnerability, thereby providing input data for the generation of subsequent attack graphs.

4. The method for measuring the security of an industrial control system based on an attack graph according to claim 1, wherein in the third step, the nodes in the attack graph comprise equipment nodes and vulnerability nodes;

the device node information comprises service information, open port information and IP information of the device vulnerability, the device node information is used as the attribute of the device node, and the device node information is described by adopting five-tuple, namely device IP, device name, service with the vulnerability, service protocol and service port;

the vulnerability node information comprises CVE\CNNVD numbers, CWE classification, authority-raising capability identifiers and CVSS scores in the atomic attack rules, is integrated on vulnerability nodes marked by vulnerability IDs as node attributes, and is described by four tuples, namely vulnerability IDs, vulnerability numbers, vulnerability types and vulnerability scores;

preprocessing data according to the network topology analysis and the vulnerability information collection result, and summarizing the data into a device information table, a vulnerability information table and a device relation table which are used as inputs of an attack graph generation algorithm.

5. The attack graph-based industrial control system security measurement method according to claim 1, wherein in the fourth step, the vulnerability node measurement quantifies the availability of vulnerability nodes and vulnerability hazards according to scanned device vulnerability information; vulnerability node availability is defined by an "attack probability" field in the CAPEC library, the { low, medium, high } quantification of the attack probability is represented as {0.3,0.6,0.9}, a low score indicates a low possibility of being attacked, and a high score indicates a high possibility of being attacked; the vulnerability score of the vulnerability node adopts the vulnerability assessment score of the CVSS, which is fully divided into 10 scores, and the higher the score is, the larger the vulnerability hazard is, the lower the score is, and the lower the vulnerability hazard is.

6. The attack graph-based industrial control system security metric method of claim 1, wherein in step four, the system security metrics include a starting node metric and a non-starting node metric;

a. start node metric

Since the starting node has acquired the authority and no attacked condition exists, the attacked probability of the starting equipment node defaults to 1 to represent that all the authorities of the equipment are acquired, and since the starting node has no forward node, the ingress degree is 0, and therefore the danger score of the starting node is equal to the own danger score of the starting node;

b. non-originating node metrics

The non-initial node calculates the accumulated attacked probability of the upper layer equipment node and the local layer equipment node and the equipment risk score by combining the attacked probability and the equipment risk score of the upper layer equipment node while considering the vulnerability node connected with the local node, and the system security measure is obtained according to the calculation of the risk score of the multi-layer accumulated equipment node;

the attack probability of the non-initial node is calculated as shown in the formula III:

wherein d _i Indicating the node degree of entry, U _m Representing the probability of being attacked by the mth upper node connected with the equipment node; the method considers the degree of node incidence and the influence of the attack probability of the upper layer node on the node of the layer, and the larger the node incidence is, the larger the attack probability of the node is; the greater the probability of being attacked by the upper layer node, the greater the probability of being attacked by the local layer node;

The risk score for the non-initiating node is calculated as formula IV:

wherein U is _m 、U _n Representing the probability of being attacked by the m, n-th upper node connected with the equipment node, R _m Representing a risk score of an mth upper node connected to the equipment node;

the risk score of the non-initial node is calculated by considering the influence of the attack probability of the upper node on the node of the layer, and meanwhile, the risk score of the upper node is calculated in a cumulative way, and the greater the node incidence, the greater the node risk score; the greater the probability of the upper node being attacked, the greater the risk score of the node of the layer; the greater the risk score of the upper node is, the greater the risk score of the present node is, and finally the risk score R of the target node is _dest And the method is obtained through multi-layer attack path accumulation calculation.

7. The method for measuring the safety of an industrial control system based on an attack graph according to claim 1, wherein in the fourth step, the attack path comprises a nested path and a parallel path; carrying out quantitative analysis on a key attack path by combining a system safety metric value, introducing an asset value index to measure in the analysis process, wherein the asset value is determined by node access degree and asset importance, the asset importance index divides the assets into ten grades from 1 to 10, 10 is very important, and 1 is very unimportant; meanwhile, according to the node access degree appearing in the current attack graph, the highest access degree is used as the standard, the other access degrees are normalized, the access degree of the initial node and the target node is defaulted to be 1, the weight reduction processing is not carried out, and finally the asset value is obtained by the product of the asset importance and the access degree, as shown in the formula V:

P _value ＝P _significance *d _io (Ⅴ)

Wherein P is _value Representing asset value, P _significance Representing asset importance, d _io Representing the node access degree after normalization processing;

a. nested path analysis

Nodes in the path set of the nested paths do not comprise a common starting node, and the key paths in the case are selected and calculated as follows:

wherein, path _sign U as a path key index _j Represents the attack probability of the j-th device node in the path set, R _i Representing the risk score, P, of the ith device node in the path set _valuei Representing asset value of an ith device node in the path set; the key path of the nested path takes the attack hop count as a main calculation basis, and the path with fewer attack hop counts is generally the key path, and the path with more attack hop counts can become the key path only when the attack rate and the danger score of the intermediate hop node are larger;

b. parallel path analysis

The path set of parallel attack paths is represented as N parallel nodes excluding common start node and end node, and the key paths for this case are selected as follows:

Path _sign ＝max{U _i *R _i *P _valuei } i＝(1，2，...k) (Ⅶ)

U _i representing the probability of an ith device node in a path set being attacked, R _i Representing the risk score, P, of the ith device node in the path set _valuei Representing asset value of an ith device node in the path set; finally, the selection of the critical path is obtained by comparing the critical indexes of the N parallel paths;

and synthesizing analysis results of the nested paths and the parallel paths, and calculating the importance of the paths through the quantization indexes to obtain the key attack path.

8. A server, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the attack graph-based industrial control system security metrics method of any of claims 1-7.

9. A computer readable medium having stored thereon a computer program, wherein the computer program when executed by a processor implements the attack graph-based industrial control system security metric method of any of claims 1-7.