面向城市轨道交通工控系统的入侵检测系统设计

发布时间：2018-05-22 07:25

本文选题：城市轨道交通工控系统 + 网络信息安全　；参考：《北京交通大学》2017年硕士论文

【摘要】：随着城市人口的不断增加,作为人们出行的主要交通工具之一的城市轨道交通系统,已经变得越来越重要。城市轨道交通的安全稳定运行则是由城市轨道交通工控系统来控制的,其运行的安全性直接关系到人民生命财产安全。随着城市轨道交通安全事件的不断发生,城市轨道交通工控系统信息安全问题已经引起了各方的广泛关注,并已然成为人们研究的热点问题。本文基于城市轨道交通工控系统信息安全的现状,在分析攻击者对工控系统的各种可能的入侵之后,针对这些入侵设计出城市轨道交通工控系统入侵检测系统。本文主要内容包括四个部分。(1)根据城市轨道交通工控系统的安全需求、整体框架结构、脆弱性以及入侵途径,得出了城市轨道交通工控系统所面临的信息安全问题,并针对城市轨道交通工控系统中常用的Modbus/TCP协议的脆弱性进行分析,总结得出因Modbus/TCP协议的脆弱性而导致的城市轨道交通工控系统各种可能被入侵的类型。(2)根据城市轨道交通工控系统的不同入侵类型,设计出了与之相对应的Snort入侵检测规则。(3)介绍了用于设计城市轨道交通工控系统入侵检测系统的软件和工具,并设计出了基于Modbus/TCP工控协议的城市轨道交通工控系统入侵检测系统。(4)搭建了城市轨道交通工控系统入侵检测系统测试平台,并采用白盒测试法,测试城市轨道交通工控系统入侵检测系统的可用性以及入侵检测规则的有效性。测试结果表明,本文所设计的城市轨道交通工控系统入侵检测系统可以正常的捕获入侵数据包并在Web网页动态显示其入侵信息,并且所设置的Snort入侵检测规则也满足检测需求。该系统为城市轨道交通的安全运营打下良好的基础。图29幅,表8个,参考文献42篇。
[Abstract]:With the increasing of urban population, urban rail transit system, as one of the main means of transportation, has become more and more important. The safe and stable operation of urban rail transit is controlled by the industrial control system of urban rail transit, and the safety of its operation is directly related to the safety of people's life and property. With the continuous occurrence of urban rail transit safety events, the information security of urban rail transit industrial control system has attracted extensive attention, and has become a hot issue. Based on the present situation of information security in urban rail transit industrial control system, after analyzing various possible intrusions of industrial control system by attackers, this paper designs an intrusion detection system for urban rail transit industrial control system. The main contents of this paper include four parts. (1) according to the security requirements, the whole frame structure, the vulnerability and the way of intrusion of the industrial control system of urban rail transit, the information security problems faced by the industrial control system of urban rail transit are obtained. The vulnerability of Modbus/TCP protocol, which is commonly used in the industrial control system of urban rail transit, is analyzed. It is concluded that various types of possible intrusion of urban rail transit industrial control system caused by the fragility of Modbus/TCP protocol.) according to the different types of urban rail transit industrial control system intrusion, This paper designs the corresponding Snort intrusion detection rule. It introduces the software and tools used to design the intrusion detection system of urban rail transit industrial control system. The intrusion detection system of urban rail transit industrial control system based on Modbus/TCP is designed, and the test platform of intrusion detection system of urban rail transit industrial control system is built, and the white box test method is adopted. The usability of intrusion detection system and the effectiveness of intrusion detection rules in urban rail transit industrial control system are tested. The test results show that the intrusion detection system designed in this paper can capture the intrusion packets and display the intrusion information dynamically on the Web web page, and the Snort intrusion detection rules can meet the detection requirements. The system lays a good foundation for the safe operation of urban rail transit. 29 figures, 8 tables, 42 references.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP273

【相似文献】