| 题名 | ModbusTCP深度解析与异常检测方法研究 |
| 作者 | 张盛山 |
| 学位类别 | 硕士 |
| 答辩日期 | 2014-05-28 |
| 授予单位 | 中国科学院沈阳自动化研究所 |
| 导师 | 尚文利 |
| 关键词 | ModbusTCP Netfilter 支持向量机 粒子群算法 |
| 其他题名 | Study on Deep Packet Inspection and Intrusion Detection of ModbusTCP |
| 学位专业 | 模式识别与智能系统 |
| 中文摘要 | 随着工业控制系统自动化和信息化的加速融合，工业控制系统信息安全形势越来越严峻。以伊朗核设施遭受震网病毒攻击为代表的层出不穷的安全事件引起了业界广泛关注，颠覆了传统上人们认为工业控制系统不存在信息安全隐患这一错误观念。早期工业控制系统相对孤立和封闭，是信息孤岛，因而工业通讯协议往往缺乏信息安全方面的考虑，缺乏相应的安全机制，这是造成工控系统信息安全脆弱的一个重要原因。Modbus是工业通讯协议的典型代表，广泛应用于工业控制系统中，本文将重点研究保障Modbus通讯安全。本文首先阐述了工业控制系统信息安全脆弱性和现有的研究成果，深刻的剖析了现行研究方法的优势与不足。重点分析了Modbus通讯协议存在的设计缺陷和安全问题，并且基于Linux内核Netfilter/Iptables框架设计了一种ModbusTCP协议深度解析与过滤的防火墙技术。该方法属于通讯协议应用层空间的访问控制方法，主要由两部分构成，分别是内核空间的扩展匹配单元和用户空间的规则设置单元。ModbusTCP深度解析与过滤机制是本文对ModbosTCP通讯进行安全防护的核心，提供了能够标识ModbusTCP数据包的相应的协议关键字段支持和完整性检查功能。在此基础之上，本文进一步设计了一套适合于工业控制系统场景下的防火墙安全策略，该“白名单”策略要求明确指出哪些通讯流量是必需的，除此之外的通讯数据包均被禁止穿越防火墙。ModbusTCP深度解析与过滤机制与“白名单”安全策略相结合的方法，禁止了非必要的Modbus通讯流量，从而极大程度地削减了系统可能存在的风险敞口，将系统存在的安全隐患限定在可控的范围之内。事实上，存在于“白名单”上的ModbusTCP通讯数据流量亦有一定的可能性存在着恶意的企图，为了及时发现穿越“白名单”的数据流量中可能存在的异常情况，本文设计了一种基于支持向量机的工业控制系统ModbusTCP通讯异常检测算法。该方法以Modbus功能码序列为研究对象，首先将网络中的Modbus功能码序列变换为能够反映工业控制系统网络通讯序列特性的相同维度的向量，然后建立了基于SVM的异常检测模型，并且利用粒子群算法对该模型进行了参数寻优和结构优化，提升了计算的效率。PSO-SVM检测模型具有不依赖于规则、不受具体工控场景制约的特性，与前面的基于Netfilter/Iptables框架的ModbusTCP协议深度解析防火墙协同工作，形成了一个较为完备的工业控制系统信息安全边界防御体系。仿真实验验证了ModbusTCP深度解析与过滤机制根据“白名单”安全规则能够拦截系统通讯所非必需的流量，PSO-SVM模型能够有效检测出异于ModbusTCP通讯的序列特性的异常行为。 |
| 索取号 | TN915.04/Z76/2014 |
| 英文摘要 | With the accelerating integration of informationization and automation in industrial control system, the information security situation becomes more and more severe.The incident that Iran’s nuclear facility suffered from Stuxnet, a worm virus targerting Industrial control system, whitch is a representative of the endless stream of security incidents similar, caused widespread concern in the academic community. And this is the powerful proof that it is a misconception that information risks and vulnerabilities don’t exist in the industrial control system. Early industrial control systems are relatively isolated and closed, so industrial communication protocols are designed without too much consideration on information security. Lacking of appropriate security mechanisms make industrial control system quite vulnerable. As a typical representative of the industrial communication protocol, Modbus is widely used in industrial control systems, this article will focus on the protection of Modbus communication security.Design flaws of Modbus and vulnerabilities of indutrial control system information security are is elaborated. With consideration of the advantages and disadvantages of related research work, a deep packet inspection technology is proposed, that the ModbusTCP packet will be deeply parsed and filtered according the content of application layer. This method based on Netfilter/Iptables framework in the Linux kernel, is made up of two parts, including the kernel part and userspace part. The deep packet inspection of ModbusTCP provides the support for identifying the corresponding protocol fields and integrity check. Furthermore, a security policy that is suitable for industrial control system scene is designed, and the policy requires the specifications about which ModbusTCP traffic should be allowed cross the deep packet inspection firewall. In the same time traffic not on the “whitelist” will be forbidden. Obviously, this policy can reduce the risk of being attacked and security risks are limited to a controllable range. In an extreme case, traffic present in the "whitelist" can be with malicious intent. A ModbusTCP communication anomaly detection algorithm based on SVM is designed whose structure and parameters are optimized by particle swarm optimization. Before the detection, the Modbus function code sequence is mapped into a vector of the same dimentison which refelect the sequence characteristic of the industrial control system communication. The PSO-SVM model is independent of specific industrial scene. The PSO-SVM method and deep packet inspection firewall make up a comprehensive industrial control system information security boundary defense system together. |
| 语种 | 中文 |
| 产权排序 | 1 |
| 页码 | 56页 |
| 分类号 | TN915.04 |
| 内容类型 | 学位论文 |
| 源URL | [http://ir.sia.ac.cn/handle/173321/14820]  |
| 专题 | 沈阳自动化研究所_工业控制网络与系统研究室 |
| 推荐引用方式 GB/T 7714 | 张盛山. ModbusTCP深度解析与异常检测方法研究[D]. 中国科学院沈阳自动化研究所. 2014. |
| 个性服务 |
| 查看访问统计 |
| 相关权益政策 |
| 暂无数据 |
| 收藏/分享 |
除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。
修改评论