基于软件机器人的工控靶场应用软件行为模拟  

Software robot-based application behavior simulation for cyber security range in industrial control field

作　　者：刘志尧 张格 刘红日 张旭[3,4] 陈翊璐 王佰玲[2,3,4] LIU Zhiyao;ZHANG Ge;LIU Hongri;ZHANG Xu;CHEN Yilu;WANG Bailing(China Industrial Control Systems Cyber Emergency Response Team,Beijing 100040,China;Weihai Cyber Guard Technologies Co.,Ltd.,Weihai 264209,China;School of Computer Science and Technology,Harbin Institute of Technology,Weihai 264209,China;School of Cyberspace Science,Harbin Institute of Technology,Harbin 150001,China)

机构地区：[1]国家工业信息安全发展研究中心,北京100040 [2]威海天之卫网络空间安全科技有限公司,威海264209 [3]哈尔滨工业大学计算机科学与技术学院,威海264209 [4]哈尔滨工业大学网络空间安全学院,哈尔滨150001

出　　处：《北京航空航天大学学报》2024年第7期2237-2244,共8页Journal of Beijing University of Aeronautics and Astronautics

基　　金：国家重点研发计划(2020YFB2009502)。

摘　　要：工控靶场为开展工业控制系统(ICS)安全研究提供重要支撑。面向工控靶场关键任务之一的应用软件行为模拟,提出一种软件机器人方法以实现工控靶场应用软件行为的逼真模拟。考虑软件图形界面及软件内在显隐式规则,提出基于尺度不变特征变换(SIFT)图像相似度的软件菜单采集算法及混合状态机模型对应用软件行为进行建模。针对软件机器人的智能化问题,使用深度Q网络(DQN)算法驱动软件机器人对应用软件行为进行自主学习,同时结合多重经验回访和多重目标网络对DQN算法进行优化。实验结果表明:基于DQN的软件机器人能够对工控软件进行有效学习,且优化后的DQN算法自主学习效果更佳。The cyber security range in the industrial control field provides important support for studies on industrial control system(ICS) security.The application behavior simulation is a crucial task for the cyber security range in the industrial control field.Therefore,a software robot method was proposed to realistically simulate the application behavior for the cyber security range in the industrial control field.By considering software graphical interfaces and explicit and implicit software rules,a software menu acquisition algorithm based on scale invariant feature transform(SIFT) for image similarity,as well as a hybrid hierarchical state machine model was developed to model application behaviors.In view of the intelligent problem of the software robot,a deep Q network(DQN)algorithm was utilized to drive the software robot to autonomously learn the application behavior.At the same time,the DQN algorithm was optimized by combining multiple experience replays and multiple target networks.The experiment results show that the software robot based on DQN can effectively learn the industrial control software,and the optimized DQN algorithm has a better autonomous learning effect.

关 键 词：工控靶场 应用软件行为模拟 软件机器人 混合状态机 深度Q网络 

分 类 号：TP393.09[自动化与计算机技术—计算机应用技术]