본문 바로가기
KERD
논문KCI 등재

특정 도메인에서의 공격 그래프 적용 가능성에 대한 타당성 분석

Feasibility Analysis on the Attack Graph Applicability in Selected Domains

박성진|유재관|이희주|전세희|홍수연|김휘강|장준호
한국컴퓨터정보학회 (The Korean Society Of Computer And Information)|2023.05|한국컴퓨터정보학회논문지 (Journal of The Korea Society of Computer and Information)|제28권 제5호|pp. 57-66|DOI https://doi.org/10.9708/jksci.2023.28.05.057

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

CloudCPS시스템 모델링공격 그래프위협 모델링Attack graphSystem modellingThreat modelling
주제분류컴퓨터학

초록

본 논문에서는 Enterprise 네트워크 이외 환경에서의 공격 그래프 연구 중 최근 5년간 가장 많이연구된 사이버-물리 시스템(CPS) 환경에 대한 공격 그래프 연구 동향을 살펴보고, 기존 연구의 한계와 앞으로 나아갈 방향을 분석한다. 최근 5년간 발표된 공격 그래프 논문 150여 편 중 35편이CPS 환경을 대상으로 하고 있으며, 본 논문에서는 CPS 환경의 보안 측면 특징을 살펴보고, 대상연구들을 이러한 특징들에 따라 물리 시스템 모델링 여부와 네트워크 단절 구간에 대한 고려 여부의 두 가지 관점으로 분류 및 분석한다. 본 논문에서 소개한 20편의 논문 중 절반이 CPS 환경의 특징을 제대로 반영하지 못하며, 나머지 절반의 연구가 물리 시스템 모델링과 네트워크 단절구간 중 하나씩을 다루고 있다. 본 논문에서는 이러한 상황을 바탕으로 CPS 환경에서의 공격 그래프 연구가 직면한 어려움을 진단하고 이에 따라 앞으로의 CPS 환경 공격 그래프 연구는 국가주도 연구, 공개된 상용 시스템을 대상으로 한 연구가 주를 이룰 것으로 분석한다.

Abstract

In this paper, a research trend of attack graph studies for Cyber-Physical System (CPS) environments is surveyed, and we analyse the limitations of previous works and prospect the future directions. 35 among around 150 attack graph studies conducted within 5 years target CPS, and we inspect key features of CPS environment in the security aspect. Also, we categorize and analyze target studies in the aspect of modelling physical systems and considering air gaps, which are derived as key features of the security aspects of CPS. Half of 20 research that we surveyed do not reflect those two features, and other studies only consider one of the two features. In this circumstance, we examine challenges that attack graph studies on CPS environment face. Finally, we expect state-led studies or studies targeting open-spec commercial CPS will dominate.

참고문헌 (51)

  1. Phillips, "A graph-based system for network-vulnerability analysis", Proceedings of the 1998workshop on New security paradigms, pp.71~79 (1998)
  2. Jha, Sheyner, "Two formal analyses of attack graphs", Proceedings 15th IEEE Computer Security Foundations Workshop, pp.49~63 (2002)
  3. Sheyner, "Automated generation and analysis of attack graphs", Proceedings 2002 IEEE Symposium on Security and Privacy, pp.273~284 (2002)
  4. Ou, Xinming, "MulVAL: A Logic-based Network Security Analyzer", Proceedings of the 14th conference on USENIX Security Symposium, 14, pp.8~ (2005)
  5. Hong, "HARMS: Hierachical Attack Representation Models for Network Security Analysis", Proceedings of the 10th Australian Information Security Management Conference (2012)
  6. Kerem Kaynar, "Distributed Attack Graph Generation", IEEE Transactions on Dependable and Secure Computing, 13(5), pp.519~532 (2015), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  7. Jin B. Hong, "A survey on the usability and practical applications of Graphical Security Models", Computer Science Review, 26, pp.1~16 (2017), Elsevier BV[DOI]
  8. Frigault, "Measuring Network Security Using Bayesian Network-Based Attack Graphs", 32nd Annual IEEE International Computer Software and Applications Conference (2008)
  9. Joy, "Precise Estimation of Local Probabilities for Bayesian Attack Graph Analysis", IEEE 12th Annual Information Technology, Electronics and Mobile Communication Conference (2021)
  10. Gallon, "CVSS Attack Graphs", 2011 Seventh International Conference on Signal Image Technology &Internet-Based Systems (2012)
  11. Keramati, "CVSS-based security metrics for quantitative analysis of attack graphs", International eConference on Computer and Knowledge Engineering, pp.2013~ (2013)
  12. Lu, "Ranking Attack Graphs with Graph Neural Networks", Proceedings of the 5th International Conference on Information Security Practice and Experience, pp.345~359 (2009)
  13. "Web of Science"[URL]
  14. "ACM Digital Library"[URL]
  15. "IEEE Xplore"[URL]
  16. "Ptolemy project"[URL]
  17. David Kushner, "The real story of stuxnet", IEEE Spectrum, 50(3), pp.48~53 (2013), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  18. Kesler, Brent, "The vulnerability of nuclear facilities to cyber attack", Strategic Insights, 10(15) (2011)
  19. "Stuxnet virus was planted by Israeli agents using USB sticks, according to new report"[URL]
  20. "MITRE ATT&CK for ICS"[URL]
  21. Tianlei Zang, "Integrated fault propagation model based vulnerability assessment of the electrical cyber-physical system under cyber attacks", Reliability Engineering & System Safety, 189, pp.232~241 (2019), Elsevier BV[DOI]
  22. Hasan, "Towards Optimal Cyber Defense Remediation in Cyber Physical Systems by Balancing Operational Resilience and Strategic Risk", 2019 IEEE Military Communications Conference (2019)
  23. Meyur, "A Bayesian Attack Tree Based Approach to Assess Cyber-Physical Security of Power System", 2020 IEEE Texas Power and Energy Conference (TPEC) (2020)
  24. Castiglione, "hazard driven threat modelling for cyber physical systems", CPSIOTSEC'20: Proceedings of the 2020 Joint Workshop on CPS&IoT Security and Privacy, pp.13~24 (2020)
  25. Bhattacharya, "Automated Adversary Emulation for Cyber-Physical Systems via Reinforcement Learning", 2020 IEEE International Conference on Intelligence and Security Informatics (2020)
  26. Abdelaziz Khaled, "Assessing the Severity of Smart Attacks in Industrial Cyber-Physical Systems", ACM Transactions on Cyber-Physical Systems, 5(1), pp.1~28 (2020), Association for Computing Machinery (ACM)[DOI]
  27. Semertzis, "Quantitative Risk Assessment of Cyber Attacks on Cyber-Physical Systems using Attack Graphs", 2022 10th Workshop on Modelling and Simulation of Cyber-Physical Energy Systems (MSCPES) (2022)
  28. Zhang, "Quantitatively Assessing the Cyber-to-Physical Risk of Industrial Cyber-Physical Systems", Proceedings of the 2020 on Great Lakes Symposium on VLSI, pp.439~444 (2020)
  29. Haque, "Integrating Mission-Centric Impact Assessment to Operational Resiliency in Cyber-Physical Systems", 2020 IEEE Global Communications Conference (2020)
  30. Buczkowski, "Optimal Security Hardening over a Probabilistic Attack Graph: A Case Study of an Industrial Control System using CySecTool", Sat-CPS '22:Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, pp.21~30 (2022)
  31. Alaa T. Al Ghazo, "A2G2V: Automatic Attack Graph Generation and Visualization and Its Applications to Computer and SCADA Networks", IEEE Transactions on Systems, Man, and Cybernetics: Systems, 50(10), pp.3488~3498 (2020), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  32. Xie, "Risk assessment method of power plant industrial control information security based on Bayesian attack graph", Journal of Electrical Systems, 17(4), pp.529~541 (2021)
  33. Choi, "Probabilistic Attack Sequence Generation and Execution Based on MITRE ATT&CK for ICS Datasets", CSET '21: Cyber Security Experimentation and Test Workshop (2021)
  34. "ATT&CK"[URL]
  35. Kern, "Model-based Attack Tree Generation for Cybersecurity Risk-Assessments in Automotive", 2021 IEEE International Symposium on Systems Engineering (ISSE) (2021)
  36. Ling, "Generating Threat Models and Attack Graphs based on the IEC 61850 System Configuration description Language", SAT-CPS '21: Proceedings of the 2021 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, pp.98~103 (2021)
  37. "MAL"[URL]
  38. Lukas Gressl, "Design Space Exploration for Secure IoT Devices and Cyber-Physical Systems", ACM Transactions on Embedded Computing Systems, 20(4), pp.1~24 (2021), Association for Computing Machinery (ACM)[DOI]
  39. Shuning Hou, "An Ontology-Based Dynamic Attack Graph Generation Approach for the Internet of Vehicles", Frontiers in Energy Research, 10 (2022), Frontiers Media SA[DOI]
  40. Birte Glimm, "HermiT: An OWL 2 Reasoner", Journal of Automated Reasoning, 53(3), pp.245~269 (2014), Springer Science and Business Media LLC[DOI]
  41. Horrocks, "SWRL: A Semantic Web Rule Language Combining OWL and RuleML", W3C Member submission, 21(79), pp.1~31 (2004)
  42. Ming Li, "Strategies for Practical Hybrid Attack Graph Generation and Analysis", Digital Threats: Research and Practice, 3(4), pp.1~24 (2022), Association for Computing Machinery (ACM)[DOI]
  43. Ling, "Securing Communication and Identifying Threats in RTUs: A Vulnerability Analysis", ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security, pp.1~7 (2022)
  44. Ge, "A Hybrid Attack Graph Analysis Method based on Model Checking", 2022 Tenth International Conference on Advanced Cloud and Big Data (CBD) (2022)
  45. "Critical Infrastructure Sectors"[URL]
  46. "Protect Nation Core Foundation"[URL]
  47. "Common Vulnerability Scoring System v3.1:Specification Document"[URL]
  48. "Lazarus Group"[URL]
  49. "Kimsuky"[URL]
  50. "Sandworm Team"[URL]
  51. "Russian hackers preparing new cyber assault against Ukraine-Microsoft report"[URL]

관련 논문AI추천

사이버-물리 시스템의 보안 프레임워크 개발을 위한 보안 요구사항 분석 연구김정녀, 김주만, 박수열, 정보흥, 최욱진대한임베디드공학회 · 대한임베디드공학회논문지2012 · 제7권 제5호공격 그래프 상의 보안 메트릭 사용 방안 조사김휘강, 이경민한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2018 · 제23권 제12호사이버 공격·방어 시뮬레이션 연구 동향강지호, 김형선, 김휘강, 송민근, 송유찬, 이재연, 장준호, 최재웅한국정보보호학회 · 정보보호학회논문지2025 · 제35권 제5호중간자 PLC를 이용한 CPS 은닉형 공격 실험환경 구축 방안장엽, 김신규, 신혁기, 이우묘한국정보보호학회 · 정보보호학회논문지2018 · 제28권 제1호동적 네트워크 환경에 적용 가능한 Attack Graph 모델 연구김인성, 김태규, 김휘강, 문주연한국정보보호학회 · 정보보호학회논문지2018 · 제28권 제2호복잡한 사이버-물리시스템의 확장성, 안전성 및 보안성 연구서예령, 이재우한국산업보안연구학회 · 한국산업보안연구2021 · 제11권 제1호

이 간행물의 다른 논문 (19건)

사물인터넷 기반의 스마트 디바이스를 이용하는 청소기 제어 시스템신예호pp. 1-8신경망을 이용한 차로 속도의 정확한 예측편동현, 표창우pp. 9-15제한된 레이블 데이터에 대한 Mean Teacher 반지도학습을 활용한 견고한 포트홀 이미지 분류김인기, 김범준, 곽정환pp. 17-28신경망을 활용한 낙서 이미지 예측조규철, 이해찬pp. 29-381983년 AFKN-TV의 위성중계방송 실시를 둘러싼 한미 교섭과정에 대한 연구윤상길pp. 39-47
원문 보기