본문 바로가기
KERD
논문KCI 등재

운영 기술 환경에서 수동적 스캐닝 기반 장치 식별의 비교 분석

A Study of Passive Scanning-based Device Identification in Operational Technology Environments

김홍근|박세연|조성제|안석현|박민수
한국소프트웨어감정평가학회 (Korea Software Assessment and Valuation Society)|2023.09|한국소프트웨어감정평가학회 논문지 (Journal of Software Assessment and Valuation)|제19권 제3호|pp. 105-118|DOI 10.29056/jsav.2023.09.12

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

IoT운영 기술장치 식별네트워크 스캐닝네트워크 트래픽 특징 정보
주제분류컴퓨터학

초록

보안 위험을 완화하기 위해서는 조직의 자산을 식별하고 보안 취약점을 제거해야 한다. 자산 식별을 위해기존 IT 환경에서는 능동적 스캐닝과 수동적 스캐닝 기법을 적용해왔다. 본 논문에서는 먼저 기존 네트워크스캐닝 방식을 OT 시스템에 적용할 때의 문제점을 살펴본다. 수동적 스캐닝 기법을 적용하여 OT 장치를 식별할 때 필요한 네트워크 트래픽의 특징 정보를 선택하기 위해, OT 장치와 유사한 특성을 가진 IoT 장치 식별 연구에서 사용된 네트워크 트래픽 특징(TTL, TCP Window Size, IAT 등)을 분석하였다. 또한, 네트워크트래픽 특징 정보의 유형을 식별하고, 이를 기반으로 효과적인 OT 장치 식별을 위한 앞으로 해결해야 할 연구 이슈들을 제시한다.

Abstract

To mitigate security risks, organizational assets must be identified and security vulnerabilities eliminated. active scanning and passive scanning techniques have been applied in existing IT environments to identify assets.. In this paper, we first examine the problems of applying the existing network scanning methods to OT systems. Then, to select network traffic features required when identifying OT devices by applying a passive scanning, we analyze network traffic features (TTL, TCP Window Size, IAT, etc.) used in prior studies on identifying IoT devices which have similar properties to OT devices. In addition, we recognize the types of network traffic features, and present research issues to be addressed for effective identification of OT devices.

참고문헌 (54)

  1. "Guide to Operational Technology (OT) Security" (2022)[URL]
  2. "State of Operational Technology and Cybersecurity Report" (2022)[URL]
  3. "A SANS 2021 Survey:OT/ICS Cybersecurity" (2021)[URL]
  4. "The State of ICS/OT Cybersecurity in 2022 and Beyond" (2022)[URL]
  5. "RISI Online Incident Database" (2015)[URL]
  6. H. Pulkkinen, "Safe security scanning of a production state automation system", pp.2022
  7. Pedro Miguel Sanchez Sanchez, "A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets", IEEE Communications Surveys & Tutorials, 23(2), pp.1048~1077 (2021), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  8. J. M. Banoczi, "IT Asset Management: Financial Services", National Institute of Standards and Technology, pp.1800~1805 (2018)
  9. O. Giorgio, "Asset Discovery Tools Supporting Cybersecurity Inventory" (2022), POLITECNICO DI TORINO
  10. Elias Bou-Harb, "Cyber Scanning: A Comprehensive Survey", IEEE Communications Surveys & Tutorials, 16(3), pp.1496~1519 (2014), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  11. "Nmap network scanning: The official Nmap project guide to network discovery and security scanning" (2009)[URL]
  12. "p0f v3. p0f official website" (2014)[URL]
  13. Safe Active Scanning for Energy Delivery Systems Final Report, "J, Helms", Lawrence Livemore National Lab, ~ (2017)
  14. O. Pospisil, "Active Scanning in the industrial control systems", IEEE International Symposium on Computer Science and Intelligent Controls (ISCSIC), pp.227~232 (2021), IEEE
  15. T. Hanka, "Impact of Active Scanning Tools for device discovery in industrial network", Security, Privacy, and Anonymity in Computation, Communication, and Storage (SpaCCS), Proceedings 13, pp.557~572 (2020), Springer
  16. A. Keliris, "Remote Field Device Fingerprinting Using Device-Specific Modbus Information", IEEE 59th International Midwest Symposium on Circuits And Systems (MWSCAS), pp.1~4 (2016), IEEE
  17. X. Feng, "Characterizing Industrial Control System Devices on the Internet", IEEE 24th International Conference on Network Protocols (ICNP), pp.1~10 (2016), IEEE
  18. M. Cash, "On Automating BACnet Device Discovery and Property Identification", ICC 2021 - IEEE International Conference on Communications, pp.1~6 (2021), IEEE
  19. A. Wedgbury, "Automated Asset Discovery in Industrial Control systems-exploring the problem", 3rd International Symposium for ICS &SCADA Cyber Security Research (ICS-CSR), pp.73~83 (2015), ICS-CSR
  20. D. Formby, "Who's in Control of Your Control System? Device Fingerprinting for Cyber-Physical Systems", Network and Distributed System Security Symposium (2016), NDSS
  21. AT. AI. Ghazo, "ICS", SCADA Device Recongnition: A Hybrid Communication-Patterns and Passive-fingerprinting Approach, IEEE Symposium on Integrated Network and Service Management (IM), pp.2019[DOI]
  22. M. Abdularazzaq, "Industrial Control System (ICS) Network Asset Identification and Risk Management" (2018), HALMSTAD University
  23. Haein Kang, "Limitation of Scanning Tools for Asset Discovery in Operational Technology Networks", Korea Software Congress, pp.920~922 (2022), KIISE
  24. D. Duggan, "Penetration Testing of Industrial Control Systems" (2005), Sandia National Laboratories
  25. M. Caselli, "On feasibility of device fingerprinting in industrial control systems", Critical Information Infrastructures Security:8th International Workshop (CRITIS), pp.155~166 (2013), Springer
  26. W. A. Conklin, "IT vs OT Security:A Time to Consider a Change in CIA to Include Resilience", 49th Hanwaii International Conference on System Sciences (HICSS), pp.2642~2647 (2016), IEEE
  27. M. Miettinen, "IoT Sentinel: Automated device-type identification for security enforcement in IoT", IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pp.2177~2184 (2017), IEEE
  28. Arunan Sivanathan, "Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics", IEEE Transactions on Mobile Computing, 18(8), pp.1745~1759 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  29. B. Bezawada, "Behavioral Fingerprinting of IoT devices", Proceedings of the 2018 workshop on attacks and solutions in hardware security, pp.41~50 (2018), ACM
  30. M. R. Shahid, "IoT Devices Recognition Through Network Traffic Analysis", IEEE International Conference on big data (big data), pp.5187~5192 (2018), IEEE
  31. Vijayanand Thangavelu, "DEFT: A Distributed IoT Fingerprinting Technique", IEEE Internet of Things Journal, 6(1), pp.940~952 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  32. L. Bai, "Automatic Device Classification from Network Traffic Streams of Internet of Things", IEEE 43rd Conference on Local Computer Networks (LCN), pp.1~9 (2018), IEEE
  33. N. Msadek, "IoT device fingerprinting: Machine learning based encrypted traffic analysis", IEEE Wireless Communications and Networking Conference (WCNC), pp.1~8 (2019), IEEE
  34. S. A. Hamad, "IoT Device Identification via network-Flow Based Fingerprinting and Learning", 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, BigDataSE), pp.2019[DOI]
  35. Samuel Marchal, "AuDI: Toward Autonomous IoT Device-Type Identification Using Periodic Communication", IEEE Journal on Selected Areas in Communications, 37(6), pp.1402~1412 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  36. A. Aksoy, "Automated IoT Device Identification using Network Traffic", IEEE International Conference on Comunications (ICC), pp.1~7 (2019), IEEE
  37. R. R. Chowdhury, "Network Traffic Analysis based IoT Device Identification", Proceedings of the 2020 4th International Conference on Big Data and Internet of Things, pp.79~89 (2020), ACM
  38. N. Najari, "Network Traffic Modeling For IoT-device Re-identification", International Conference on Omni-layer Intelligent Systems (COINS), pp.1~6 (2020), IEEE
  39. L. Babun, "Z-IoT: Passive Device-class Fingerprinting of ZigBee and Z-Wave IoT Devices", IEEE International Conference on Communications (ICC), pp.1~7 (2020), IEEE
  40. Monika Skowron, "Traffic Fingerprinting Attacks on Internet of Things Using Machine Learning", IEEE Access, 8, pp.20386~20400 (2020), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  41. Vian Adnan Ferman, "Machine Learning Challenges for IoT Device Fingerprints Identification", Journal of Physics: Conference Series, 1963(1), pp.012046~ (2021), IOP Publishing[DOI]
  42. F. Yin, "IoT ETEI: End to-End IoT Device Identification Method", IEEE Conference on Dependable and Secure Computing (DSC), pp.1~8 (2021), IEEE
  43. Ola Salman, "A machine learning based framework for IoT device identification and abnormal traffic detection", Transactions on Emerging Telecommunications Technologies, 33(3), pp.e3743~ (2019), Wiley[DOI]
  44. Kahraman Kostas, "IoTDevID: A Behavior-Based Device Identification Method for the IoT", IEEE Internet of Things Journal, 9(23), pp.23741~23749 (2022), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  45. YourThings dataset Alrawi Omar, "SoK: Security Evaluation of Home-Based IoT Deployments", IEEE Symposium on Security and Privacy (SP), pp.1362~1380 (2019), IEEE
  46. Y. Meidan, "Detection of Unauthorized IoT Devices Using Machine Learning Techniques", arXiv preprint arXiv:1709, 04647, ~ (2017)
  47. "Passive OS Fingerprinting" (2011)[URL]
  48. Amir R Khakpour, "An Information-Theoretical Approach to High-Speed Flow Nature Identification", IEEE, 2013, pp.21(4), 1076~1089[DOI]
  49. L Wang, "On the impact of packet inter arrival time for early stage traffic identification", IEEE International Conference on Internet of Things (iThings) and Green Computing and Communications (greenCom) and Cyber, Physical and Social Computing (CPSCom) and Smart Data (SmartData), pp.510~515 (2016), IEEE
  50. Sakthi Vignesh Radhakrishnan, "GTID: A Technique for Physical Device <italic>and<", italic> Device Type Fingerprinting, 2015, pp.12(5), 519~532[DOI]
  51. "ICS-Security Tool Github" (2018)[URL]
  52. "Capture files from 4sics geek lounge" (2018)[URL]
  53. "Secure water treatment tesetbed" (2018)[URL]
  54. "Control System Port List" (2011)[URL]

관련 논문AI추천

기계 학습 활용 운영체제 핑거프린팅 연구 조사김휘강, 박상범, 안명식, 윤경찬한국정보보호학회 · 정보보호학회논문지2024 · 제34권 제6호OT 산업보안 강화를 위한 산업용 IoT 데이터 보호 정책김도은, 이선진, 이일구, 이하은, 한채림한국산업보안연구학회 · 한국산업보안연구2024 · 제14권 제1호보안 내재화 중심의 OT 산업보안 강화 방안류정화, 문정현, 이일구한국산업보안연구학회 · 한국산업보안연구2023 · 제13권 제1호안전한 제어시스템 환경을 위한 트래픽 분석망 설계곽진, 이은지한국정보보호학회 · 정보보호학회논문지2016 · 제26권 제5호네트워크 기반 무빙 타켓 방어의 위협 모델 및 요구사항 분석강구홍, 문대성, 박태근한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2017 · 제22권 제10호IoT 계층별 보안위협 분석 및 대응기술 개선 방안 연구원종혁, 유연우, 홍정완중소기업융합학회 · 융합정보논문지2018 · 제8권 제6호

이 간행물의 다른 논문 (11건)

불법 저작권 침해 사이트 특정을 위한 특징 정보 수집 방안 연구최은석, 박명찬, 김영모pp. 1-10이용조건별 저작권 라이선스의 계약 조건 개인화 모델 제안조용준, 김원빈, 김연경, 신동명pp. 11-21저작물성 인정과 실질적 유사성 판단의 관계 - 대법원 2022. 12. 1. 선고 2021다246804 판결을 중심으로 -김시열pp. 23-32저작권자 간 저작권 이용허락 편의성을 위한 계약 자동승인 플랫폼 모델조용준, 신동명, 김원빈, 정채윤pp. 33-43메타버스 환경에서 사용되는 디지털 에셋의 n차 창작물 유사도 판별을 위한 데이터 중복성 판별 기술김원빈, 조용준, 신동명, 노창현pp. 45-54
원문 보기