ICS/SCADA Device Recognition: A Hybrid Communication-Patterns and Passive-Fingerprinting Approach
ICS/SCADA Device Recognition: A Hybrid Communication-Patterns and Passive-Fingerprinting Approach
复制标题
ICS/SCADA 设备识别：混合通信模式和被动指纹识别方法
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Ratnesh Kumar
中科院分区：
文献类型：
--
作者：
A. Ghazo;Ratnesh Kumar
工业控制系统(ICS)和监控与数据采集(SCADA)系统是监测和监督工厂、电网、供水系统、核电站和其他关键基础设施的主干。这些系统由第三方承包商安装，由现场工程师维护，并长期运行。这使得跟踪系统更改和更新的文档具有挑战性，因为它们的一些组件信息(类型、制造商、型号等)。可能不是最新的，导致系统中可能存在无法解释的安全漏洞。设备识别是漏洞识别和防御增强的第一步，但由于传统ICS/SCADA系统缺乏完全可跟踪性，基于文档检查的典型设备识别不适用。在本文中，我们提出了一种混合通信模式和被动指纹识别的方法来识别未知设备的类型、制造商和型号。该算法使用ICS/SCADA设备的通信模式来识别设备的控制层次。同时，通信中的某些可区分特征-分组被用来识别设备制造商和型号。我们已经在Python语言中实现了这种混合方法，并在新加坡水处理SCADA试验台(ITRust)的交通数据上进行了测试。
The Industrial Control System (ICS) and Supervisory Control and Data Acquisition (SCADA) systems are the backbones for monitoring and supervising factories, power grids, water distribution systems, nuclear plants, and other critical infrastructures. These systems are installed by third party contractors, maintained by site engineers, and operate for a long time. This makes tracing the documentation of the systems’ changes and updates challenging since some of their components’ information (type, manufacturer, model, etc.) may not be up-to-date, leading to possibly unaccounted security vulnerabilities in the systems. Device recognition is useful first step in vulnerability identification and defense augmentation, but due to the lack of full traceability in case of legacy ICS/SCADA systems, the typical device recognition based on document inspection is not applicable. In this paper, we propose a hybrid approach involving the mix of communication-patterns and passive-fingerprinting to identify the unknown devices’ types, manufacturers, and models. The algorithm uses the ICS/SCADA devices’s communication-patterns to recognize the control hierarchy levels of the devices. In conjunction, certain distinguishable features in the communication-packets are used to recognize the device manufacturer, and model. We have implemented this hybrid approach in Python, and tested on traffic data from a water treatment SCADA testbed in Singapore (iTrust).