A Software-Defined Security Approach for Securing Field Zones in Industrial Control Systems
A Software-Defined Security Approach for Securing Field Zones in Industrial Control Systems
复制标题
用于保护工业控制系统中现场区域的软件定义的安全方法
DOI：
10.1109/access.2019.2924800
复制
发表时间：
2019
期刊：
影响因子：
3.9
通讯作者：
Yang Shuanghua
中科院分区：
文献类型：
--
作者：
Yang Jun;Zhou Chunjie;Tian Yuchu;Yang Shuanghua
工业控制系统(ICSS)面临着日益严峻的安全威胁。区域隔离是一般信息系统中阻止攻击传播的常用思想，已被用于ICS安全保护。它通常是通过周边安全技术实施的。然而，受影响区域内物理过程的异常状态可能通过区际信息交互作用扩散到其他区域。由于物理过程在不同区域之间的耦合，很难防止攻击影响在ICSS中的传播。本文提出了一种软件定义安全(SDSec)方法来解决这一问题。它由一个混合异常检测模块和一个多级别安全响应模块组成，这两个模块共同工作以确保ICS外勤区的安全。混合异常检测模块从网络通信和物理进程状态两个角度对异常行为进行检测。多级别安全响应模块有助于防止未经批准的数据包进行通信，从而隔离任何受危害的区域。它还会生成攻击缓解策略，以保护物理进程。通过半实物仿真验证了该方法的有效性。
Industrial control systems (ICSs) are facing increasingly severe security threats. Zone isolation, a commonly adopted idea for stopping attack propagation in general information systems, has been investigated for ICS security protection. It is usually implemented through perimeter security techniques. However, anomaly states of the physical processes in a compromised field zone may spread into other zones through the inter-zone information interaction. Due to the coupling of the physical processes between different zones, it is difficult to prevent the propagation of attack impact in ICSs. In this paper, a software-defined security (SDSec) approach is presented to address this problem. It consists of a hybrid anomaly detection module and a multi-level security response module, both of which work together to secure the ICS field zones. The hybrid anomaly detection module inspects anomaly behaviors from the perspectives of network communications and physical process states. The multi-level security response module helps prevent unapproved packets from communications, thus isolating any compromised zone. It also generates attack mitigation strategies to secure physical processes. Hardware-in-the-loop simulations are conducted to demonstrate the effectiveness of the presented approach.
登录
查看更多内容
DOI：
--
发表时间：
2018
期刊：
Int. J. Netw. Secur.
影响因子：
--
作者：
Rui-Hong Dong;Dong-Fang Wu;Qiu-yu Zhang;Zhang Tao
通讯作者：
Rui-Hong Dong;Dong-Fang Wu;Qiu-yu Zhang;Zhang Tao
DOI：
10.1109/imis.2011.82
发表时间：
2011-06
期刊：
2011 Fifth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing
影响因子：
--
作者：
Giseop No;Ilkyeun Ra
通讯作者：
Giseop No;Ilkyeun Ra
影响因子：
--
作者：
SHANNON, CE
通讯作者：
SHANNON, CE
影响因子：
--
作者：
SHANNON, CE
通讯作者：
SHANNON, CE
DOI：
10.1016/j.ijcip.2009.06.001
发表时间：
2009-10-01
影响因子：
3.6
作者：
Huang, Yu-Lun;Cardenas, Alvaro A.;Sastry, Shankar
通讯作者：
Sastry, Shankar