Chen Yang-Rong, Wang Yu, Huang Gui-Rong, Li Jun-E
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China.
ISA Trans. 2023 May;136:1-15. doi: 10.1016/j.isatra.2022.10.024. Epub 2022 Oct 29.
Tracing the sources of cyber-attacks in Power Industrial Control Systems (PICS) can help the defense systems to block the attacks, and support the decision of the grid control policies. However, there has been no work on the cyber-attack source traceback for PICS, and the methods for the Internet are not suitable for PICS in terms of fineness, real-time performance, and supporting communication protocols. Therefore, a method for tracing cyber-attacks in PICS is proposed. First, the communication network architecture of PICS and the cyber security threats to PICS are analyzed. Then, an extended hybrid tracing method (ExtHT) based on packet marking and packet logging is proposed. This method involves all the devices working at the data link layer and upper layers to achieve more fine-grained attack tracing. At the same time, taking the costs of attack tracing into consideration, a coarse-grained tracing mode is presented to improve the tracing speed. In addition, a log database optimization scheme is provided to reduce storage costs. To facilitate the application of this method in practice, a cyber-attack source tracing system and its deployment architecture are designed for PICS. Further, the applicability and limitations of ExtHT are analyzed, theory ratiocinations are given to justify our ExtHT, and the performance of our ExtHT is compared with that of existing mainstream methods. Finally, two cyber-attack scenarios against PICS are constructed and the feasibility of ExtHT is verified on them.
追踪电力工业控制系统（PICS）中的网络攻击源有助于防御系统阻断攻击，并为电网控制策略的决策提供支持。然而，目前尚未有针对PICS网络攻击源回溯的相关工作，且互联网的方法在精细度、实时性能和支持的通信协议方面并不适用于PICS。因此，提出了一种用于追踪PICS中网络攻击的方法。首先，分析了PICS的通信网络架构以及PICS面临的网络安全威胁。然后，提出了一种基于数据包标记和数据包日志记录的扩展混合追踪方法（ExtHT）。该方法涉及所有工作在数据链路层及以上层的设备，以实现更细粒度的攻击追踪。同时，考虑到攻击追踪的成本，提出了一种粗粒度追踪模式以提高追踪速度。此外，还提供了一种日志数据库优化方案以降低存储成本。为便于该方法在实际中应用，为PICS设计了一个网络攻击源追踪系统及其部署架构。进一步分析了ExtHT的适用性和局限性，进行了理论推理以证明ExtHT的合理性，并将ExtHT的性能与现有主流方法进行了比较。最后，构建了两种针对PICS的网络攻击场景，并在其上验证了ExtHT的可行性。
