为解决电力监控系统现有安全策略面对新型攻击防护能力不足的问题,文中提出一种基于对抗战术、技术和通用知识(adversarial tactics,techniques,and common knowledge,ATT&CK)框架的威胁路径构自动建方法.该方法首先基于设备间的连通状况构建网络无向图;然后依据资产分级信息构建威胁移动路径;最后依据资产分类信息、ATT&CK框架以及网络杀伤链,补全威胁移动路径信息,完成威胁路径构建.该方法不仅为电力系统安全策略的制定提供了理论依据和支持,还为检测到威胁时自适应调整网络安全策略提供了可能.
Research on Threat Path Construction Technology of Power Monitoring System Based on ATT&CK Framework
To solve the problem that the existing security strategy of power monitoring system is insufficient to defend against new attacks,this paper proposes an automatic threat path construction method based on ATT&CK framework.Firstly,the network undirected graph based on the connectivity between devices is constructed.Then,the threat movement path is constructed according to the asset classification information.Finally,according to the asset classification information,ATT&CK framework and network killing chain,the threat movement path information and the threat path construction are completed.This method not only provides a theoretical basis and support for the formulation of power system security policy,but also provides the possibility to adaptively adjust network security policy when threats are detected.
power monitoring systemnetwork securityATT&CK frameworkthreat path construction
国家科技期刊平台
NSTL
万方数据
