基于蜜罐技术的工业控制入侵捕获系统的设计与实现

发布时间：2018-05-10 17:49

本文选题：工业控制 + 网络安全　；参考：《郑州大学》2017年硕士论文

【摘要】：随着工业控制领域与互联网技术的紧密结合,越来越多的工业控制安全问题暴露在公众的视线中。传统的工业控制网络环境是封闭的,与外界互联网有着严格的网络边界划分。但是工业化与信息化的深度融合,给工业控制系统带来了更多互联网因素,因此传统网络攻击也逐渐渗透到工业控制领域。近年来工业控制网络安全事件频发,各种工业控制设备漏洞屡见不鲜,甚至高级持久性威胁(Advance Persistent Threat,APT)也出现增长的趋势。在严峻的安全形势下,必须采取相应的应对策略与防御手段。本文首先介绍了课题的研究背景与意义、国内外研究现状和研究的目的,接着叙述了工业控制和蜜罐技术相关的概念和知识,着重分析了工业控制领域存在的安全威胁和使用蜜罐技术作为防御手段的可行性,为构建入侵捕获系统奠定了基础。蜜罐技术作为一种新型的网络安全技术,在安全防御和威胁预警方面,比其他防御手段表现地更为出色。基于蜜罐技术构建的入侵捕获系统结合了入侵诱骗、数据捕获、数据分析、数据可视化和数据溯源等多种技术,是一种动态的安全防御方式。同时本文采用蜜罐技术模拟工业控制场景和设备吸引攻击者入侵。针对工业控制网络的入侵捕获技术是一种新型的工业控制网络安全防御技术。利用入侵捕获技术可以分析攻击者和网络空间引擎的行为,确定黑客的攻击手段、攻击工具和攻击模式,为工业控制领域提供专属的威胁情报信息。最后根据工业控制安全需求,对开源蜜罐框架进行二次开发,完善开源框架,引入了基于攻击信息的数据可视化和分析模块,使得系统适用于工业控制网络安全研究。本文还结合工业控制系统业务的多样性特点,设置了不同的蜜罐类型和入侵途径,有利于迷惑攻击者和网络空间搜索引擎。并且采用云主机的形式进行部署蜜罐,不同蜜罐分配不同国家的IP,使得系统在攻击数据上呈现分布性差异,对研究不同国家工业控制遭受的攻击形势具有一定的意义。
[Abstract]:With the close combination of industrial control field and Internet technology, more and more industrial control safety problems are exposed to the public. The traditional industrial control network environment is closed and has a strict network boundary division with the outside Internet. However, the deep integration of industrialization and information has brought more Internet factors to industrial control systems, so traditional network attacks have gradually penetrated into the industrial control field. In recent years, industrial control network security incidents occur frequently, various industrial control equipment vulnerabilities are common, and even advanced Persistent threat APT is also increasing. In the severe security situation, must adopt the corresponding response strategy and the defense method. This paper first introduces the research background and significance of the subject, the current research situation and the purpose of the research at home and abroad, and then describes the concepts and knowledge related to industrial control and honeypot technology. The security threats in the industrial control field and the feasibility of using honeypot technology as a defense method are analyzed emphatically, which lays a foundation for the construction of intrusion capture system. Honeypot technology, as a new type of network security technology, is better than other defense methods in security defense and threat warning. The intrusion capture system based on honeypot technology is a dynamic security defense system, which combines many technologies such as intrusion decoy, data capture, data analysis, data visualization and data traceability. At the same time, the honeypot technology is used to simulate the industrial control scene and equipment to attract attackers. Intrusion capture technology for industrial control network is a new type of industrial control network security defense technology. Intrusion capture technology can be used to analyze the behavior of attackers and cyberspace engines, determine the attack means, attack tools and attack patterns, and provide the specific threat information for the industrial control field. Finally, according to the requirement of industrial control security, the open source honeypot framework is redeveloped to perfect the open source framework, and the data visualization and analysis module based on attack information is introduced, which makes the system suitable for the research of industrial control network security. Combined with the diversity of industrial control system business, different honeypot types and intrusion approaches are set up in this paper, which is helpful to confuse attackers and search engines in cyberspace. The honeypot is deployed in the form of cloud host and the IPs of different countries are allocated by different honeypots, which makes the system present distributed differences in attack data, which has a certain significance for studying the attack situation of industrial control in different countries.
【学位授予单位】：郑州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP273

【相似文献】