Method of Network Security States Prediction and Risk Assessment for Industrial Control System Based on HMM

doi:10.3969/j.issn.1671-1122.2020.09.012

Abstract

Abstract:

In this paper, the Hidden Markov Model is used to characterize the risk state transition relationship of an industrial control network attack scene, and the network risk state is predicted by the correlation probability between the risk state and the security alarm event. This paper defines the quantitative factors of network assets, threats and vulnerability and their calculation methods, normalizes the quantitative factors and applies them to the analysis of the overall risk value of the network. This paper constructs a simulation environment based on the typical four-layer industrial control system structure, and simulates and verifies the method by MATLAB. Experimental results show that the proposed method can be used in the dynamic assessment process of security states and risk value.

Key words: industrial control system, network security state, Hidden Markov Model

CLC Number:

TP309

LI Shibin, LI Jing, TANG Gang, LI Yi. Method of Network Security States Prediction and Risk Assessment for Industrial Control System Based on HMM[J]. Netinfo Security, 2020, 20(9): 57-61.

Figures/Tables 4

References 10

[1]	CHEN Xiuzhen, ZHENG Qinghua, GUAN Xiaohong, et al. Quantitative Hierarchical Threat Evaluation Model for Network Security[J]. Journal of Software, 2006,17(4):885-897. doi: 10.1360/jos170885 URL
	陈秀真, 郑庆华, 管晓宏, 等. 层次化网络安全威胁态势量化评估方法[J]. 软件学报, 2006,17(4):885-897.
[2]	YANG Hongyu, CHU Runlin, LI Dongbo. A New Method for Network Security Situation Assessment[J]. Microelectronics&Computer, 2015,32(1):30-34.
	杨宏宇, 褚润林, 李东博. 一种新的网络安全态势评估方法[J]. 微电子学与计算机, 2015,32(1):30-34.
[3]	WU Kun, BAI Zhongying. Trusted Network Security Situational Awareness and Forecast Based on SPA[J]. Journal of Harbin Institute of Technology, 2012,12(3):117-123.
	吴琨, 白中英. 集对分析的可信网络安全态势评估与预测[J]. 哈尔滨工业大学学报, 2012,12(3):117-123.
[4]	POOLSAPPASIT N, DEWRI R, RAY I. Dynamic Security Risk Management Using Bayesian Attack Graphs[J]. IEEE Transactions on Dependable and Secure Computing, 2012,9(1):61-74. doi: 10.1109/TDSC.2011.34 URL
[5]	XI Rongrong, YUN Xiaochun, ZHANG Yongzheng, et al. An Improved Quantitative Evaluation Method for Network Security[J]. Chinese Journal of Computers, 2015,38(4):51-60.
	席荣荣, 云晓春, 张永铮, 等. 一种改进的网络安全态势量化评估方法[J]. 计算机学报, 2015,38(4):51-60.
[6]	WANG Zhigang, LI Linsen. Security Quantitative Evaluation of Industrial Control Systems[J]. Communications Technology, 2019,52(12):3050-3057.
	王智刚, 李林森. 工业控制系统安全量化评估[J]. 通信技术, 2019,52(12):3050-3057.
[7]	TAN Xiaobin, ZHANG Yong, CUI Xiaolin, et al. Using Hidden Markov Models to Evaluate the Real-time Risks of Network[C]// IEEE. 2008 IEEE International Symposium on Knowledge Acquisition & Modeling Workshop, December 21-22, 2008, Wuhan, China. NJ: IEEE, 2008: 490-493.
[8]	GB/T 20984-2007 Information Security Technology Risk Assessment Specification for Information Security[S]. Beijing: Standards Press of China, 2007.
	GB/T 20984-2007 信息安全技术信息安全风险评估规范[S]. 北京: 中国标准出版社, 2007.
[9]	MIIT.Evaluation Method of Information Security Protection Capability of Industrial Control System [EB/OL]. http://www.miit.gov.cn/n1146295/n1652858/n1652930/n3757016/c5761045/content.html,2020-4-15.
	工业和信息化部信息化和软件服务业司. 工业控制系统信息安全防护能力评估方法[EB/OL]. http://www.miit.gov.cn/n1146295/n1652858/n1652930/n3757016/c5761045/content.html,2020-4-15.
[10]	ARNES A, VALEUR F, VIGNA G, et al. Using Hidden Markov Models to Evaluate the Risks of Intrusions[EB/OL]. https://www.mendeley.com/catalogue/2ba743d8-ef50-3f06-a8f4-2581cfc03efa/, 2020-4-15.

[1]	Wenli SHANG, Long YIN, Xianda LIU, Jianming ZHAO. Construction Technology and Application of Industrial Control System Security and Trusted Environment [J]. Netinfo Security, 2019, 19(6): 1-10.
[2]	Wenli SHANG, Xiule ZHANG, Xianda LIU, Long YIN. Construction Method and Verification of Local Trusted Computing Environment in Industrial Control Network [J]. Netinfo Security, 2019, 19(4): 1-10.
[3]	Ruiying CHEN, Zemao CHEN, Hao WANG. Design and Optimization of Security Monitoring and Controlling Protocol in Industrial Control Systems [J]. Netinfo Security, 2019, 19(2): 60-69.
[4]	Zongping LV, Lei DING, He SUI, Zhaojun GU. Network Security Risk Analysis of Industrial Control System Based on Time Automata [J]. Netinfo Security, 2019, 19(11): 71-81.
[5]	Xin GENG. Research on the Industrial Control Systems Security Architecture of Chinese Tobacco Industry [J]. Netinfo Security, 2017, 17(9): 34-37.
[6]	Dongmei CHENG, Biao YAN, Hui WEN, Limin SUN. The Design and Implement of Rule Matching-based Distributed Intrusion Detection Framework for Industry Control System [J]. Netinfo Security, 2017, 17(7): 45-51.
[7]	Yubin WANG, Si CHEN, Nan CHENG. Research on Industrial Control System Security Defense [J]. Netinfo Security, 2016, 16(9): 35-39.
[8]	Kunlun PENG, Wei PENG, Dongxia WANG, Qianqian XING. Research Survey on Security Issues in Cyber-Physical Systems [J]. Netinfo Security, 2016, 16(7): 20-28.
[9]	Xiao-shan WANG, An YANG, Zhi-qiang SHI, Li-min SUN. New Trend of Information Security in Industrial Control Systems [J]. Netinfo Security, 2015, 15(1): 6-11.
[10]	WANG Qi-kui, LI Xin, ZHAO Fu. Research on Information Security for Industrial Control System and the Solution for Numerical Control Network [J]. 信息网络安全, 2014, 14(9): 120-122.
[11]	WANG Zhi-qiang, WANG Hong-kai, ZHANG Xu-dong, SHEN Xiao-jun. Research on Industrial Control System Security Risks and Countermeasures [J]. 信息网络安全, 2014, 14(9): 203-206.
[12]	. NULL [J]. , 2014, 14(1): 0-0.