Design And Implementation Of Hierarchical Evaluation System For Industrial Control System Security

With the advent of industrial intelligence and a myriad of attack methods,Industrial Control Systems are facing serious security issues,causing devastating wastage.In recent years,with potential vulnerabilities multiplication,ICS incidents are increasing rapidly.Therefore,the need for rethinking security in Industrial Control systems has become apparent.The security assessment of the industrial control system can help users understand the security of the system,grasp the vulnerabilities,and find threats to the system,which help best defend their most critical assets.Dealing with such a challenge requires a new approach to evaluating ICS security.This paper presents an assessment system based on layer evaluation.With the aid of an attack graph,we designed and implemented a model which describes the threat of ICS used for dynamic evaluation.We describe the priority of vulnerability remediation by calculating the pivotal attack steps in an attack graph.In view of the above two points,we also hierarchically demonstrate the threat and vulnerability assessment.The main research contents are as follows:First of all,considering that the normal attack graph cannot reveal the threat information of ICS precisely,an extended attack graph is proposed with the help of using vulnerabilities and alerts.There are two approvals in research into this part.One is constructing the absorption Markov attack graph by exploiting the exploitability score of the vulnerability and characterizing the threat of the system.Another is refactoring the alert related attack graph using the threat information of the alert which is collected via proposing a prediction algorithm and utilizing the Hidden Markov Model.Secondly,although extensive research has been carried out on solving the critical attack steps in the internet environment,no single study exists which is suitable for the ICS environment.Hence,considering the characteristics of the ICS,we defined the criticality score for the attack step.The first step in this process was to solve the minimum set of attack steps that can block the attack based on the cut set.After that,we incorporate the service impact of ICS equipment,score the cut set,and selected the optimal attack steps set.Synthesizing the possibility of the attacker selecting the attack step and the probability of the attack step being successful,the final stage of the study comprised the criticality score of the attack step,which aims to select the critical attack steps.Finally,in order to solve the problem of too few security assessment indicators,this study seeks to construct an evaluation model,which is assessed in layers from the vulnerability and threat perspective.Both qualitative and quantitative methods were used in this investigation.In the aspect of system vulnerability assessment,the score of the attack step is used to obtain the ranking factor,then the comprehensive vulnerability repair benefit defines the attack defense score to quantify the vulnerability of the system.In the aspect of system threat assessment,the score reflected by the alarm is calculated by quantifying the threat information such as system security status,current attack stage,and attack classification.Collectively,with the support of those research contents,a hierarchical evaluation system for the industrial control system is implemented.In terms of taking functional testing,we found that the system can accurately predict the threat information,provide constructive suggestions for vulnerability fixes,and complete the threat and vulnerability assessment for the ICS system effectively.