工业控制系统场景指纹及异常检测  

Scenario fingerprint of an industrial control system and abnormally detection

作　　者：彭勇[1,2] 向憧[2] 张淼[1] 陈冬青[2] 高海辉[2] 谢丰[2] 戴忠华[2] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]中国信息安全测评中心,北京100085

出　　处：《清华大学学报（自然科学版）》2016年第1期14-21,共8页Journal of Tsinghua University(Science and Technology)

摘　　要：工业控制系统(ICS)是监测和控制电力、水务、石油天然气、化工、交通运输、关键制造等国家关键基础设施行业物理过程运行的信息物理系统(CPS)。基于ICS系统中控制通信数据流的持续性和稳定性,该文提出了从ICS系统工业控制协议交互模式中提取系统级行为特征来作为ICS场景指纹的创新思路和方法。ICS场景指纹不仅能用于识别特定ICS系统,而且还能用于建立ICS系统正常行为基准并进一步用于识别系统的异常行为。该文构建了采用真实工控设备和软件以及仿真物理过程的实验系统并进行了相关实验验证测试。实验结果表明,ICS场景指纹是ICS系统安全研究方面的一种非常有前景的方法。Industrial control systems （ICSs） are cyber-physical systems （CPSs） which supervise and control physical processes in critical infrastructure industries such as electric power, water treatment, oil ＆ natural gas exploration, transportation, and chemical industry. Based on the observation of ICS＇stable and persistent communication data flow control patterns, a concept and a methodology of ICS scenario fingerprinting were proposed which analyze industrial control protocol interactive behavior to represent ICS system level normal behavior characteristics. ICS scenario fingerprint can identify unique ICS installation, while being used as a more generalized method to establish ICS systems＇behavior benchmark and further being used to identify ICS systems＇abnormal behavior. Experiments were made to validate the proposed viewpoint, which use real equipment for ICS cyber domain and use simulation for ICS physical domain. Experimental results demonstrate that ICS scenario fingerprinting technique provides ICS security research with a promising method.

关 键 词：工业控制系统 信息物理系统 场景指纹 异常检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]