黄桂容,李俊娥,王宇,朱朝阳,周亮,缪思薇.结合时延特征与安全评估的电力工控系统攻击溯源方法[J].电测与仪表,2025,62(10):1-12. HUANG Guirong,LI Jun’e,WANG Yu,ZHU Chaoyang,ZHOU Liang,MIU Siwei.Tracing method based on delay feature and security assessment for cyber-attack in power industrial control system[J].Electrical Measurement & Instrumentation,2025,62(10):1-12.
结合时延特征与安全评估的电力工控系统攻击溯源方法
Tracing method based on delay feature and security assessment for cyber-attack in power industrial control system
The existing cyber-attack tracing methods mainly focus on the Internet and are not suitable for power industrial control system (PICS) due to its high real-time requirements and special communication protocols. In PICS, the end-to-end delays between the nodes are consistent, and most of the terminals are embedded terminals with limited resources and a single business. Therefore, a tracing method based on delay feature and security assessment for cyber-attack is proposed in this paper. A delay feature library is built according to the delay features of messages, which can be matched with the delay feature of the attack message to obtain the suspicious terminals. The security assessment of suspicious terminals is performed by assessment indicators to locate the attack source. Experiments and analysis show that the proposed method can traceback in non-internat protocoal (IP) network, and the impact on the performance of terminals in PICS is within acceptable limits. Compared with existing fine-grained tracing methods, the proposed method is relatively easy to deploy.
