摘要:
近年来，工业互联网的安全事件日益频发，尤其是工业控制系统(industrial control system, ICS)，该现象揭示了目前ICS中已经存在较多的安全隐患，并且那些针对ICS安全隐患的大多数攻击和防御方法都需要对工控协议进行分析.然而，目前ICS中大多数私有工控协议都具有与普通互联网协议完全不同的典型特征，如结构、字段精度、周期性等方面，导致针对互联网协议的逆向分析技术通常都无法直接适用于工控协议.因此，针对工控协议的逆向分析技术已经成为近几年学术界和产业界的研究热点.首先结合2种典型工控协议，深入分析和总结了工控协议的结构特征.其次，给出了工控协议逆向分析框架，深入剖析了基于程序执行和基于报文序列的工控协议逆向分析框架的特点，并依次从人机参与程度和协议格式提取方式这2个角度，重点针对基于报文序列的工控协议分析方法进行详细阐述和对比分析.最后探讨了现有逆向分析方法的特点及不足，并对工控协议逆向分析技术的未来研究方向进行展望与分析.
Abstract:
In recent years, the security incidents of the industrial Internet have become more frequent, especially the industrial control systems (ICS), which reveals that there are already many hidden security risks in ICS. Meanwhile, most of the attack and defense methods against those ICS security risks need to analyze the industrial control protocol. However, most of the private industrial control protocols in ICS have typical characteristics that are completely different from ordinary Internet protocols, such as structure, field accuracy and periodicity, and as a result, those reverse analysis techniques for Internet protocols are generally not directly applicable to industrial control protocols. Therefore, the reverse analysis technology for industrial control protocols has become a research hotspot in academia and industry recently. In the paper, firstly, the structural characteristics of industrial control protocols are illustrated and summarized with two typical industrial control protocols. Secondly, we introduce the frameworks for reverse analysis of industrial control protocols, and deeply analyze the characteristics of frameworks based on program execution and packet sequence respectively. Then the industrial control protocols reverse methods based on packet sequence are analyzed and compared in detail from multiple perspectives, such as the degree of human-computer participation and the extraction method of protocol format. Finally, we discuss the characteristics and shortcomings of the existing reverse analysis methods, and prospect and analyze the future research directions of industrial control protocol reverse analysis technology.
下载:
