【作者】 刘子龙；

【导师】 周纯杰；

【作者基本信息】 华中科技大学 ， 网络空间安全， 2024， 硕士

【摘要】 油气生产系统作为典型的工业控制系统,承担着保障能源供应和国家经济安全的重要任务。云计算的引入在推动系统转型升级的同时,也增加了系统所面临的信息安全风险。准确分析系统安全风险并进行动态风险评估已成为当前研究重点。本文针对云环境下信息安全相关问题并结合系统体系架构、运行特点,给出了云环境下异常检测和风险评估相结合的动态风险评估框架,明确以预先采取防御措施对系统进行安全防护的风险评估方法的必要性。考虑到油气生产工业控制系统信息层和物理层数据异构的特点,分别设计信息层和物理层异常检测模型实现对系统异常情况的精准识别和处理。在信息层,采用异常入侵检测方法,而现有方法未考虑流量数据复杂、稀缺的特点,针对该问题提出了一种融合多尺度一维卷积神经网络和双向长短期记忆网络的类不平衡异常流量检测模型,所提模型在UNSW-NB15数据集上具有较高的精确度。在物理层,采用示功图异常检测方法,考虑到物理层计算资源有限,提出了轻量注意力卷积神经网络的示功图异常检测模型,所提模型在保证检测精度的同时减小了计算资源和存储空间。针对云环境下风险传播过程复杂、节点间风险传播概率难以量化等问题,提出了一种基于贝叶斯攻击图的动态风险评估方法。首先根据系统漏洞、拓扑结构等信息完成攻击图的自动生成,通过设计第一、二类环路消除算法得到贝叶斯攻击图模型结构;其次,设计基于MapReduce分布式EM算法对贝叶斯攻击图参数动态学习;最后在获取异常检测实时证据后,依据贝叶斯攻击图和资产损失对系统风险进行动态量化并综合漏洞利用情况对系统风险值进行修正。通过设计攻击场景的方式,在给定目标系统中验证了动态风险评估方法的有效性和适用性。最后构建了动态风险评估系统,在搭建硬件实物的基础上,依据动态风险评估需求,对软件整体架构以及各功能模块展开详细设计,通过攻击重放的形式模拟攻击,并对动态风险评估效果进行可视化展示。更多还原

【Abstract】 The oil and gas production system,as a typical industrial control system,bears the important responsibility of ensuring energy supply and national economic security.The introduction of cloud computing has not only promoted the transformation and upgrading of the system but also increased the information security risks faced by the system.Accurately analyzing system security risks and conducting dynamic risk assessment has become a current research focus.In this paper,focusing on information security issues in cloud environments and combining system architecture and operational characteristics,we propose a dynamic risk assessment framework that combines anomaly detection and risk assessment in cloud environments.It emphasizes the necessity of assessing system security protection risks by taking preventive measures in advance.Considering the heterogeneity of data between the information layer and the physical layer in oil and gas production industrial control systems,separate designs of anomaly detection models for the information layer and the physical layer are proposed to achieve accurate identification and handling of system anomalies.In the information layer,an anomaly intrusion detection method is used.Existing methods do not consider the complexity and scarcity of flow data.To address this issue,a model for detecting classimbalanced abnormal traffic is proposed,which integrates multi-scale one-dimensional convolutional neural networks and bidirectional long short-term memory networks.The proposed model demonstrates high accuracy on the UNSW-NB15 dataset.In the physical layer,an abnormal dynamometer card detection method is employed.Considering limited computational resources at the physical layer,a lightweight attention convolutional neural network model for abnormal dynamometer card detection is proposed.This model ensures detection accuracy while reducing computational resources and storage space.A dynamic risk assessment method based on Bayesian Attack Graphs is proposed to address the complexity of risk propagation and the difficulty in quantifying risk propagation probabilities between nodes in cloud environments.Firstly,the automatic generation of attack graphs is achieved based on information such as system vulnerabilities and topology.The structure of the Bayesian Attack Graph model is obtained by designing first and secondorder loop elimination algorithms.Secondly,a MapReduce-based distributed EM algorithm is designed for dynamic learning of the parameters of the Bayesian Attack Graph.Finally,after obtaining real-time evidence from anomaly detection,the system’s risk is dynamically quantified based on the Bayesian Attack Graph and asset losses,with adjustments made to the system risk value based on the comprehensive exploitation of vulnerabilities.By designing attack scenarios,the effectiveness and applicability of the dynamic risk assessment method are validated in a given target system.The dynamic risk assessment system was ultimately constructed on the foundation of physical hardware.Based on the requirements of dynamic risk assessment,detailed designs were developed for the overall software architecture and various functional modules.Attacks were simulated through attack replays,and the effectiveness of dynamic risk assessment was visualized for display.更多还原