상용 OS기반 제어시스템 확률론적 취약점 평가 방안 연구
A Study on the Probabilistic Vulnerability Assessment of COTS O/S based I&C System
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
본 연구는 즉시 패치가 어려운 상용 운영체제 기반의 계측제어시스템의 취약점 평가 방안 및 시간의 경과에 따른 위험의 크기를 정량적으로 파악하는 것이다. 연구 대상은 상용 OS가 탑재된 계측제어시스템의 취약점 발견과 영향의 크기이다. 연구에서는 즉각 취약점 조치가 힘든 디지털 계측제어시스템의 취약점 분석 및 조치방법을 연구함으로써, 계측제어시스템이 존재하는 핵심기반시설의 전체적인 사이버보안 위험과 취약점을 정량적으로 파악하는 것이다. 본 연구에서 제안한 확률론적 취약점 평가 방안은 즉각적인 취약점 패치가 어려운 상용 운영체제 기반의 계측제어시스템에서 취약점 패치 우선 순위 및 패치가 불 가능시 수용 가능한 취약점의 임계값 설정, 공격 경로에 대한 파악을 가능하게 하는 모델링 방안을 제시한다.
Abstract
The purpose of this study is to find out quantitative vulnerability assessment about COTS(Commer- cial Off The Shelf) O/S based I&C System. This paper analyzed vulnerability's lifecycle and it's impact. this paper is to develop a quantitative assessment of overall cyber security risks and vulnerabilities I&C System by studying the vulnerability analysis and prediction method. The probabilistic vulnerability assessment method proposed in this study suggests a modeling method that enables setting priority of patches, threshold setting of vulnerable size, and attack path in a commercial OS-based measurement control system that is difficult to patch an immediate vulnerability.
참고문헌 (18)
- 오상윤, "Vulnerability Case Analysis of Wireless Moving Vehicle", 한국융합학회논문지, 9(8), pp.41~46 (2018), 한국융합학회[DOI]
- 조진근, "PC보안 강화를 위한 기술적 취약점 진단항목 개선 연구", 융합정보논문지, 9(3), pp.1~7 (2019), 중소기업융합학회[DOI]
- "Recommended Practice for Patch Management of Control Systems", Department of Homeland Security, 23~24 (2008)
- "Digital I&C System Diagram" (2018)[URL]
- Pubudu, "Non-Homogeneous Stochastic Model for Cyber Security Predictions", The Journal of Information Security, pp.12~24 (2018)[DOI]
- Karen Scarfone, "An analysis of CVSS version 2vulnerability scoring", ESEM '09 Proceedings of the 2009 3rd International Symposium on Empirical Software Engineering and Measurement, pp.516~525 (2009)
- Sasith M. Rajasooriya, "Cyber Security: Nonlinear Stochastic Models for Predicting the Exploitability", Journal of Information Security, 08(02), pp.125~140 (2017), Scientific Research Publishing, Inc.[DOI]
- P. Ammann, "Scalable, graph-based network vulnerability analysis", Proceedings of the 9th ACM conference on Computer and communications security, pp.217~224 (2002)
- S. Jah, "Two formal analyses of attack graphs", The Proceedings 15th IEEE Computer Security Foundations Workshop (2002)
- Subil Abraham, "Cyber Security Analytics: A Stochastic Model for Security Quantification Using Absorbing Markov Chains", Journal of Communications, 9(12), pp.899~907 (2014), Engineering and Technology Publishing[DOI]
- Andrew Reibman, "Numerical transient analysis of markov models", Computers & Operations Research, 15(1), pp.19~36 (1988), Elsevier BV[DOI]
- Bruce A. Craig, "Estimation of the transition matrix of a discrete-time Markov chain", Health Economics, 11(1), pp.33~42 (2002), Wiley[DOI]
- Swapna S. Gokhale, "Analysis of Software Fault Removal Policies Using a Non-Homogeneous Continuous Time Markov Chain", Software Quality Journal, 12(3), pp.211~230 (2004), Springer Science and Business Media LLC[DOI]
- A. Andan, "Verifying continuous time Markov chains", International Conference on Computer Aided Verification, pp.269~276 (2005)
- G. Laurent, "Vulnerability Discrimination Using CVSS Framework", 2011 4th IFIP International Conference on New Technologies, Mobility and Security (2011)
- Andrew Reibman, "Markov and Markov reward model transient analysis: An overview of numerical approaches", European Journal of Operational Research, 40(2), pp.257~267 (1989), Elsevier BV[DOI]
- N. Skku, "Exploitability analysis using predictive cyber security framework", 2015 IEEE 2nd International Conference on Cybernetics (2015)
- J. Y. Kim, "Vulnerability Discovery in Multi version software systems", 10th IEEE High Assurance Systems Engineering Symposium (2007)