网络空间中工控设备快速发现与精细识别关键技术研究

项目名称： 网络空间中工控设备快速发现与精细识别关键技术研究

项目编号： No.U1536107

项目类型： 联合基金项目

立项/批准年度： 2016

项目学科： 管理科学

项目作者： 朱红松

作者单位： 中国科学院信息工程研究所

项目金额： 67万元

中文摘要： 近年来，不断有重要工业系统遭受来自网络空间的扫描、渗透和破坏，网络空间安全逐渐受到世界各国政府的重视。工控设备拥有控制物理环境的独特能力，同时关联物理空间与网络空间。谁能精准定位和控制网络空间中的关键工控设备，谁就可能掌握未来网络空间战的主动权。本课题以工业系统漏洞扫描和安全测评为应用背景，以发现网络空间关键工控设备为目标，探索多维信息融合的工控设备快速识别技术架构，研究基于深度学习的精细化指纹模型提取方法、基于决策树的最优指纹调度扫描技术，以及基于分布式动态博弈的抗阻断扫描技术；研发并搭建指纹生成与工控设备发现原型系统验证提出的研究方法与技术。通过研究，拟解决工控设备识别中准确度与扫描效率的矛盾，提高网络工控蜜罐识别能力和被保护工控设备的发现能力，为漏扫和安全评测提供高价值工控设备资源，同时也为我国在网络空间对抗中抢占有利势位进行理论与技术储备。

中文关键词： 工业控制系统；网络空间扫描；设备分类识别；自动指纹生成；抗阻断扫描

英文摘要： In recent years, there have been more industrial system suffering from scanning, penetration and sabotage from cyberspace. A growing number of countries have begun to pay attention to the cyberspace security. Industrial control equipment(ICE), as either cyberspace equipment or physical-space equipment, has become many countries’ major concern of their critical infrastructure security. In the future, those who can precisely position and control critical ICE in cyberspace may become the winners of the cyberspace war. This research project sets vulnerability scanning and security assessment of ICE as the application background. The main objective is to discover critical ICE in cyberspace. To achieve this objective, we will firstly build the overall technical architecture about rapid identification of ICE through multidimensional information fusion. Specifically, our research will explore automatic fined fingerprinting method based on deep learning and use decision tree to optimize fingerprinting scheduling. Also, the project will explore an anti-blocking scan technique on the basis of distributed dynamic gaming theoretic. In order to evaluate the proposed methods and techniques, a prototype of ICE fingerprint and discovery system will be developed for verification. Through this research, it is expected to solve the contradiction between identification accuracy and scanning efficiency of ICE. By scanning hidden ICE behind protective equipment and excluding deceptive network honeypot, our research project can discover highly valuable candidate ICE for further security analysis. In the view of global cyberspace battlefield, this research would contribute to enhance our competitiveness with influential theory and technologies.

英文关键词： industrial control system;cyberspace scanning;device category identification;automatic fingerprint generation;anti-block scanning