RISK：审计工业控制系统中的“为时已晚无法恢复”漏洞

中文摘要 AI 辅助

工业控制系统（ICS）的安全性至关重要。然而，大多数ICS安全研究工作侧重于检测ICS攻击，而对检测后恢复的关注则少得多。在本文中，我们通过联合审计ICS的检测与恢复来探讨这一未被充分研究的领域。具体而言，我们定义了“为时已晚无法恢复”（TLTR）漏洞，该漏洞允许攻击在检测之前耗尽可用的恢复余量，从而使得后续的恢复过程因余量不足而无法将ICS带回安全状态。为了审计ICS是否存在TLTR漏洞，我们开发了RISK，这是一个自动化框架，能够发现并验证可能的TLTR攻击场景。RISK综合地对PLC控制逻辑、攻击检测策略、恢复程序以及ICS的运行行为进行静态和动态建模与分析，以生成具有具体攻击参数的TLTR攻击场景。我们在三个ICS测试平台以及一个真实的化肥生产工厂上对RISK进行了评估。在三个测试平台上，共生成并确认了392个TLTR攻击，而现有ICS审查工具只能发现其中一小部分。在真实工厂中，RISK识别出了一个关键的TLTR漏洞，该漏洞已由工厂工程师验证。

英文摘要

The security of industrial control systems (ICS) is important. Yet most ICS security efforts focus on the detection of ICS attacks, with much less attention to the recovery after detection. In this paper, we address this underexplored area by jointly auditing the detection and recovery of ICS. Specifically, we define the too-late-to-recover (TLTR) vulnerability, which allows an attack to drain the available recovery margin before being detected, such that the subsequent recovery procedure will fail to bring the ICS back to a safe state due to the insufficient margin. To audit an ICS for TLTR vulnerabilities, we develop RISK, an automated framework that discovers and validates possible TLTR attack scenarios. RISK holistically models and analyzes, statically and dynamically, the PLC control logic, attack detection policies, recovery procedures, and operational behaviors of an ICS to generate TLTR attack scenarios with concrete attack parameters. We evaluate RISK on three ICS testbeds as well as a real-world fertilizer production plant. Across the three testbeds, a total of 392 TLTR attacks are generated and confirmed, whereas only a small fraction of them can be discovered by existing ICS vetting tools. In the real-world plant, RISK identified a critical TLTR vulnerability which was validated by plant engineers.

发表机构

• Purdue University（普渡大学）
• University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）

机构由 AI 辅助整理，请以论文原文为准。

补充信息

备注

17 pages