基于蠕虫和代理的工控系统攻击建模  

Worm and Agent-based Attack Modeling for Industrial Control Systems

作　　者：韩冬松 沙乐天 赵创业 HAN Dong-song;SHA Le-tian;ZHAO Chuang-ye(School of Computer,School of Software,School of Cyberspace Security,Nanjing University of Posts and Telecommunications,Nanjing 210023,China)

机构地区：[1]南京邮电大学计算机学院、软件学院、网络空间安全学院,江苏南京210023

出　　处：《计算机与现代化》2023年第10期107-114,共8页Computer and Modernization

基　　金：国家自然科学基金面上项目(62072253)。

摘　　要：在网络安全领域,只有更好地了解攻击,才能掌握抵御技术。本文聚焦于工业控制系统中最接近工业生产设备的工业控制设备——可编程逻辑控制器PLC,不再局限于传统的“上位机-PLC-级联设备”攻击模式,通过将PLC蠕虫与PLC代理结合实现攻击适应性更强的“PLC-PLC-级联设备”攻击模式,实现一条以暴露在可直接访问环境中的PLC为源头,能够使内网环境中的所有PLC都遭受攻击的完整攻击链,在该攻击链中加入不同攻击形式并最终构建出攻击模型。通过搭建实验环境进行仿真实验,表明该攻击模型可改变工业控制系统运行状态,对工业控制系统安全运行造成威胁。最后,对于该攻击模式给出针对性的防护建议。In the field of network security,only by better understanding the attack,can we master the defense technology.This article focuses on the industrial control equipment in the industrial control system that is closest to the industrial production equipment-the programmable logic controller PLC,which is no longer limited to the traditional“host computer-PLC-cascading equipment”attack mode.Through the combination of PLC worm and PLC agent,the attack mode of“PLC-PLC-cascade device”with stronger attack adaptability is realized,and a complete attack chain that can make all PLCs in the Intranet environment be attacked by the PLC exposed to the directly accessible environment is realized.Different attack forms are added to the attack chain and the attack model is finally constructed.By building an experimental environment to conduct simulation experiments,it is proved that the attack model can change the operation state of the industrial control system and pose a threat to the safe operation of the industrial control system.Finally,targeted protection suggestions are given for this attack mode.

关 键 词：工业控制系统 可编程逻辑控制器PLC 蠕虫 代理模式 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]