【作者】 李阳；

【导师】 万明；

【作者基本信息】 辽宁大学 ， 软件工程（专业学位）， 2024， 硕士

【摘要】 工业控制系统在国家关键基础设施中扮演着重要角色。随着互联网的迅速发展,工业化和信息化正呈现越来越紧密的融合趋势,导致原本封闭的工业控制系统不断与外部网络环境接触,增加了受到外部攻击的风险。据国家信息安全漏洞库公开的数据统计,工控漏洞数量呈持续上升趋势,尤其是在2010年后,这一趋势变得更加明显。可以预见的是,随着工业互联网的持续发展和工业控制系统的日益开放,工业控制系统将面临更多的安全漏洞挑战。另外,由于工业控制系统对可用性、可靠性和实时性的注重,传统黑名单式安全技术无法有效满足工控终端自身安全防护的要求。为此,本文设计了一个基于指纹特征高效匹配的白名单防护系统,针对程序启动、文件变更、威胁告警等方面提供全面的安全保护,实现操作系统层面的自身主动安全防护,抵御针对工控终端的恶意代码攻击威胁。首先,该系统从进程和文件两方面实现了两种防护功能:针对进程防护,内核通过Hook操作捕获进程创建事件信息,通过自定义Netlink模块将得到的信息发送到用户态,在用户态进行进程信息补全后将进程信息与用户自定义的进程白名单规则进行匹配,对非白名单进程进行终止,从而及时发现入侵行为,为工控终端提供实时安全防护;针对文件防护,对用户添加的重要文件实施保护,限制文件的读写权限,定期对文件保护表进行检查,将被篡改的文件从文件保护表中删除并产生告警日志,保障文件管控模块功能有效性,同时文件敏感操作需要进行用户身份验证,并将敏感操作存储到相关日志中。其次,为了保障进程和文件防护功能的高效性,本文提出了一种基于指纹特征的双向单模式匹配技术:一方面,本文设计了一种改进SM3密码杂凑算法的指纹特征提取方法,该方法对传统SM3密码杂凑算法的压缩函数进行了优化,减少中间变量的个数并改变赋值顺序,从而实现对指纹特征的快速提取;另一方面,本文设计了一种双向单模式快速指纹匹配模型,该模型通过优化BM(Boyer-Moore)算法的预处理阶段和搜索阶段,在实现最大安全移动距离的同时,减少字符比较次数,增大模式串移动距离,从而实现快速指纹匹配。实验结果表明,本文提出的方法相比于其他同类型指纹特征提取和匹配算法具有更好的混淆性和扩散性,提高了算法的运行效率。最后,对白名单防护系统进行了需求分析和功能设计,并基于上述关键技术,本文实现了一个基于指纹特征高效匹配的白名单防护系统,该系统不仅具备进程和文件两种防护功能,还包括日志的实时记录功能以及白名单防护软件运行参数设置功能,特别是考虑到多台工控终端地理位置分散的问题,设计了统一管理平台实现远程统一管理,最终达到防止恶意代码的侵入破坏以及有效保护工控终端安全的目的。更多还原

【Abstract】 Industrial control systems play an important role in national key infrastructure.With the rapid development of the Internet,industrialization and informatization are becoming more and more closely integrated,which leads to the continuous contact between the originally closed industrial control system and the external network environment,increasing the risk of external attacks.According to publicly available data from the National Information Security Vulnerability Database,the number of industrial control vulnerabilities has been continuously increasing,especially since2010,when this trend has become more apparent.It can be predicted that with the continuous development of industrial Internet and the increasing openness of industrial control systems,industrial control systems will face more security vulnerability challenges.In addition,due to the emphasis on availability,reliability,and real-time performance in industrial control systems,traditional blacklist security technologies cannot effectively meet the security protection requirements of industrial control terminals themselves.For this purpose,this article designs a whitelist protection system based on fingerprint feature efficient matching,which provides comprehensive security protection for program startup,file changes,threat alarms,and other aspects.It realizes active security protection at the operating system level and resists malicious code attacks against industrial control terminals.Firstly,the system implements two protection functions from both process and file aspects: for process protection,the kernel captures process creation event information through Hook operation,sends the obtained information to user mode through custom Netlink module,completes process information in user mode,matches process information with user-defined process white-listing rules,terminates non white-listing processes,and timely detects intrusion behavior,providing real-time security protection for industrial control terminals;For file protection,important files added by users are protected,and their read and write permissions are restricted.The file protection table is regularly checked,and tampered files are removed from the table and an alarm log is generated to ensure the effectiveness of the file control module.At the same time,sensitive file operations require user authentication and stored in relevant logs.Secondly,in order to ensure the efficiency of process and file protection functions,this paper proposes a bidirectional single pattern matching technology based on fingerprint features.On the one hand,this paper designs a fingerprint feature extraction method that improves the SM3 password hashing algorithm.This method optimizes the compression function of the traditional SM3 password hashing algorithm,reduces the number of intermediate variables and changes the assignment order,thereby achieving rapid extraction of fingerprint features;On the other hand,this article proposes a bidirectional single mode fast fingerprint matching model,which optimizes the preprocessing and search stages of the BM(Boyer Moore)algorithm to achieve maximum safe movement distance while reducing the number of character comparisons and increasing the distance of pattern string movement,thus achieving fast fingerprint matching.The experimental results show that the method proposed in this paper has better confusion and diffusion compared to other similar fingerprint feature extraction and matching algorithms,and improves the efficiency of the algorithm.Finally,a requirement analysis and functional design of the white-listing protection system were conducted,and based on the key technologies mentioned above,this paper implemented a white-listing protection system that efficiently matches fingerprint features.The system not only has two protection functions:process and file protection,but also includes real-time logging function and whitelisting protection software operation parameter setting function.Especially considering the problem of multiple industrial control terminals being geographically dispersed,a unified management platform was designed to achieve remote unified management,ultimately achieving the goal of preventing malicious code intrusion and damage and effectively protecting the security of industrial control terminals.更多还原