• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>IEEE transactions on industrial informatics >Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks
【24h】

Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

机译：具有欺骗性虚拟主机的工业控制网络的网络物理系统安全性

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% of the monitored emulated devices.
机译：工业控制网络管理员面临的挑战是保护他们通常负责的大量关联资产。这些网络设备可能与其控制的物理过程紧密相关，人为导致的故障可能会给现实世界带来可怕的后果。动态虚拟蜜罐是观察和吸引网络入侵者活动的有效工具。本文提出了一种自我配置蜜罐的设计和实现，该蜜罐可以被动地检查控制系统网络流量并主动适应观察到的环境。与该领域的先前工作相比，分析了六种工具，以适合网络实体信息收集。 Ettercap是一种既不常用的网络安全工具，其性能却不如其他工具，因此被选中实施。利用Ettercap XML输出，开发了一种新颖的四步算法，用于自主创建和更新Honeyd配置。通过执行协作使用方案，在现有的小型校园网格和传感器网络上对该算法进行了测试。在攻击场景中，将自动创建的虚拟主机与异常行为（AB）系统配合部署。自动为虚拟主机配置了92％的目标设备独特的模拟网络堆栈行为。 AB系统会在100％受监视的仿真设备上发出警报。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号