高级检索
    徐丽娟, 王佰玲, 杨美红, 赵大伟, 韩继登. 工业控制网络多模式攻击检测及异常状态评估方法[J]. 计算机研究与发展, 2021, 58(11): 2333-2349. DOI: 10.7544/issn1000-1239.2021.20210598
    引用本文: 徐丽娟, 王佰玲, 杨美红, 赵大伟, 韩继登. 工业控制网络多模式攻击检测及异常状态评估方法[J]. 计算机研究与发展, 2021, 58(11): 2333-2349. DOI: 10.7544/issn1000-1239.2021.20210598
    Xu Lijuan, Wang Bailing, Yang Meihong, Zhao Dawei, Han Jideng. Multi-Mode Attack Detection and Evaluation of Abnormal States for Industrial Control Network[J]. Journal of Computer Research and Development, 2021, 58(11): 2333-2349. DOI: 10.7544/issn1000-1239.2021.20210598
    Citation: Xu Lijuan, Wang Bailing, Yang Meihong, Zhao Dawei, Han Jideng. Multi-Mode Attack Detection and Evaluation of Abnormal States for Industrial Control Network[J]. Journal of Computer Research and Development, 2021, 58(11): 2333-2349. DOI: 10.7544/issn1000-1239.2021.20210598

    工业控制网络多模式攻击检测及异常状态评估方法

    Multi-Mode Attack Detection and Evaluation of Abnormal States for Industrial Control Network

    • 摘要: 面向工控网的攻击策略多种多样,其最终目的是导致系统进入临界状态或危险状态,因此,基于设备状态异常的攻击检测方式相较于其他检测方法更为可靠.然而,状态异常检测中存在攻击结束时刻难以准确界定的问题,构建攻击策略及系统异常状态描述模型,基于此,提出基于状态转移概率图的异常检测方案,实验结果表明该方案能够有效检测多种攻击方式.另外,针对语义攻击对系统状态影响的定量评估难题,提出基于异常特征和损害程度指标融合分析的攻击影响定量评估方法,实现系统所处不同阶段时状态的定量评估与分析.该项工作对于识别攻击意图有重要的理论价值和现实意义.

       

      Abstract: The ultimate intentions of various attack strategies leads the control system to a critical states or dangerous states for industrial control network. As a consequence, the attack detection method based on abnormal device status exceeds any other methods in terms of reliability. Oriented to the difficulty of accurately determining the ending of attack, this paper established the attack strategies model and the abnormal status description model, and then constructed corresponding datasets under a variety of attack strategies, proposed time slice partitioning algorithm based on inflection point fusion and state feature clustering algorithm, finally constructed an anomaly detection scheme based on state transition probability graph. Experimental results indicate that this scheme can effectively detect a variety of attack strategies. In addition, the research on the quantitative evaluation of semantic attack impacting on system states is relatively weaker than any other attack pattern, such as data injection attack, denial of service attack, and man-in the middle attack. In response to the above phenomenon, with results of anomaly detection as the cornerstone, this paper proposed the scheme of quantitative evaluation of attack impact on system states, according to the fusion analysis of abnormal features and threat degree indicators, for the state changes of the system at different stages. This work has important theoretical valuation and practical significance for identifying attack intention.

       

    /

    返回文章
    返回