보안측면에서의 산업제어시스템 비정상 행위 분류

국문 초록 (Abstract)

산업제어시스템의 사이버위협 특징은 의도하지 않았다고 하더라도 피해범위가 특정 시스템뿐만 아니라 네트워크의 서비스 제공을 위협하는 수준에 도달했다는 점이다. "보안"의 일부 범위는 단지 테러리스트나 사이버 해커의 고의적인 공격에 대한 시스템의 보호를 포함하지만, 종종 더 큰 피해는 의도적인 공격보다 부주의에 의한 설정 오류 또는 장비고장 등의 비고의적인 행위로 이루어 진다. 본 논문은 고의적 공격, 실수, 장비 고장 및 소프트웨어 문제를 포함한 ICS의 모든 비정상 행위에 대한 분류를 제안하였다. ICS의 비정상 행위 분류 기준은 고의적인 공격뿐만 아니라 부주의한 행동의 공통점과 중요한 특징을 강조하기 위해 선정되었다.

다국어 초록 (Multilingual Abstract)

Cyber threats of the ICS(Industrial Control System) has been researched on the level to the threat to the network service as well as a specific system, even if the extent of damage was not intended. Although some range of “security” just include the protection of systems against the deliberate attacks of terrorists or cyber hackers, often more damage is done by carelessness, and equipment failures than by those deliberate attacks. This paper presented a taxonomy for classifying all abnormal behaviors of ICS, including deliberate attacks, inadvertent mistakes, equipment failures, and software problems. The classification criteria of ICS abnormal behaviors was selected to highlight commonalities and important features of deliberate attacks as well as inadvertent actions.

목차 (Table of Contents)

• 요약
• ABSTRACT
• I. 서론
• II. 산업제어시스템 비정상 행위 개요
• III. 산업제어시스템의 비정상행위 분류
• IV. 결론
• 참고문헌

참고문헌 (Reference)

• 1 김태식, "전력시스템의 사이버보안 위협 규명 및 분류에 대한 연구" 보안공학연구지원센터 9 (9): 53-66, 2012
• 2 전용희, "산업제어시스템 정보보호 : 개요" 한국정보보호학회 19 (19): 52-59, 2009
• 3 Nicolas Falliere, "W32. Stuxnet Dossier, Symantec Security Response, Version 1.4"
• 4 Terry Fleury, "Towards A Taxonomy of Attacks against Energy Control Systems" 290 : 71-85, 2009
• 5 Byres Security Inc., "Tofino Argon Security Appliance"
• 6 Jayne Caswell, "Survey of Industrial Control Systems Security"
• 7 Phil Muncaster, "Stuxnet-like attacks be ckon as 50 new Scada threats discovered"
• 8 Digital Bond Inc., "SCADA Protocol IDS Signature"
• 9 Wikipedia, "SCADA"
• 10 Repository for Industrial Security Incidents(RISI), "Report on Cyber Security Incidents and Trends Affecting Petroleum Industrial Control Systems" 2010
• 11 IEC, "Power Systems Management and assoicated information exchange – Data and communications security – Part 7: Network and system management (NSM) data object models"
• 12 IEC, "Power Systems Management and assoicated Information Exchange – Data and communications security – Part 5: Security for any profiles including IEC 60870-5"
• 13 NMAP, "Nmap – Free Security Scanner For Network Exploration & Security Audits"
• 14 TENABLE Network Security, "Nessus Professional"
• 15 RAPID7, "Metasploit Pro User Guide Release 4.3"
• 16 BCIT, "Industrial Security Incident Database"
• 17 Stewart Baker, "In the Dark, Crucial Industries Confront Cyberattacks"
• 18 SCADAhacker.com, "Hacking using Nma p, Nessus and Metasploit"
• 19 Igor Nai Fovino, "Design and Implementation of a Secure Modbus Protocol, In Critical Infrastructure Protection III" Springer 2009
• 20 Digital Bond Inc., "Basecamp"
• 21 Peter Huitsing, "Attack taxonomies for the Modbus protocols" 2008
• 22 John D. Howard, "An Analysis Of Security Incidents On The Internet 1989 – 1995" Carnegie Mellon University 1997
• 23 Simon Hansman, "A taxonomy of network and computer attacks" 2004
• 24 Jelena Mirkovic, "A Taxonomy of DDoS Attack and DDoS Defense Mechanisms" 34 (34): 2004
• 25 Bonnie Zhu, "A Taxonomy of Cyber Attacks on SCADA Systems" 2011
• 26 Samuel East, "A Taxonomy of Attacks on the DNP3 Protocol, In Critical Infrastructure Protection III" Springer 2009
• 27 Bill Miller, "A Survey of SCADA and Critical Infrastructure Incidents" 2012
• 28 Kevin S. Killourhy, "A Defense-Centric Taxonomy Based on Attack Manifestations" 2004