RU2753169C1 - Method for self-regulation of network infrastructure of industrial facilities under influence of security threats - Google Patents

Abstract

FIELD: computer systems.

SUBSTANCE: invention relates to the field of computer systems, namely to the network infrastructure of modern industrial facilities and methods for its automatic rebuilding upon detection of security threats. The effect is achieved due to the fact that in the claimed solution the network is rebuilt upon receipt of a signal from the security threat detection system, for which the target function of the industrial facility is formed, the graphical representation of the network infrastructure of the industrial facility, sets of connections and operations between clusters of each function from a set of functional sequences, obtained using de Bruijn graphs, and upon receipt of a security threat detection signal, compile a list of violated functions from a set of functional sequences, then choose the fastest option for rebuilding the network structure to apply and apply to the current network structure.

EFFECT: increased mobility and performance of the network, as well as the ability to neutralize security threats.

1 cl, 5 dwg

Description

The invention relates to the field of computer systems, namely to the network infrastructure of modern industrial facilities and methods of its automatic rebuilding when exposed to security threats.

The technical problem is to increase the speed of response to security threats and increase the security of the network infrastructure of industrial facilities by rebuilding the network infrastructure at the stage of detecting a security threat in such a way that the security threat cannot be realized.

The known method provides the implementation of adaptive analytics of cybersecurity of the system (US patent No. US9032521B2, published 05/12/2015, IPC H04L63 / 1433). The computer calculates the cybersecurity score of the system, depending on the level of the current network activity. The resulting score indicates the likelihood of a security breach in the system and allows you to generate a signal of suspicious network activity if the score goes beyond the established boundaries that indicate a violation. The disadvantage of this solution is its focus on indirect detection of security threats based on a computable estimate, which is determined based on signs of network activity in the system. Thus, the invention makes it possible to signal a threat, and not a violation, and also does not allow to neutralize security threats (according to clause 1 of the formula). The adaptation of the system consists in performing an automatic update of software components and is associated only with the use of a computational assessment model that responds to signs of whether a security breach is a real threat or not. At the same time, all actions to neutralize the identified security threats are performed by a person.

A known invention is a cybersecurity system that aggregates data from multiple network nodes, identifies a security incident and rebuilds workflows in response to a detected security incident (US patent No. 20200244696, published 07.30.2020, IPC H04L29 / 06; H04L9 / 00 ; H04L9 / 32). Depending on the nature of the particular security incident, the solution allows you to initiate an action plan tailored to the security operations center and its operating procedures to protect the hosts affected by the security incident.

According to claim 1, the present invention performs the identification of an automatic action to eliminate a security threat and initiates at least one automatic action to eliminate a security incident. According to claim 2, at least one automated action performed by the invention blocks malicious network traffic, at least within the monitored network segment. Thus, by responding to a security incident and blocking traffic, the invention rebuilds the network infrastructure when security incidents are detected, while maintaining autonomy from the operator. The disadvantages of this invention are the minimum set of actions to eliminate security threats, performed autonomously from the operator, as well as the use of a network security policy, which is not enough to regulate the network infrastructure of industrial facilities. This is due to the large scale of such facilities, as well as the heterogeneity of the types of networks that make up the network infrastructure of industrial facilities (client-server networks, sensor networks, decentralized networks, peer-to-peer networks of mobile devices).

The closest technical solution is a method for adaptive reconfiguration of the communication network of devices (US patent No. US7117257B2, published 03.10.2006, IPC H04Q3 / 0083). The technical solution, according to clause 7 of the formula, includes a network device for adaptive reconfiguration of a network having at least one central node and many border nodes. The device implements temporary blocking of border nodes, grouping of border nodes in accordance with the reconfiguration delay of each border node, assigning a reconfiguration delay threshold for each group of border nodes, and periodic reconfiguration of routes associated with border nodes in each group of border nodes in accordance with the specified delay threshold. This solution provides fast reconfiguration of network routes linking interconnecting nodes, where any two border nodes can be connected to each other through a central node. To improve the adaptability, mobility and performance of the network, the edge nodes connected through the central node are divided into multiple groups based on an estimate of the round-trip time delays when interacting with the central node. This allows you to separate short routes from long ones, and in turn, by replacing different sections of the route at short distances, allows you to configure short routes more often than long routes, thereby ensuring the adaptation of network capacity to changing conditions. However, this solution has several disadvantages. The division of network nodes is carried out only according to the criterion formed on the basis of an estimate of the delays in the transmission of packets between the border node and the central node and does not take into account the entire network as a whole. This reconfiguration criterion is effective for a small network with a pronounced central node through which the border nodes interact. For such a network, the gain in throughput is achieved by rebuilding network routes from the border nodes to the central one. However, this method is ineffective in cases of decentralized and peer-to-peer network infrastructures. It is advisable to introduce a network reconfiguration criterion that takes into account the set of functions performed by individual nodes of the network infrastructure, their connections with each other, as well as the computing power of network nodes, since low-resource network nodes are often used in the network infrastructure of industrial facilities: sensors and device controllers.

Moreover, the invention is not focused on mitigating security threats. The invention is aimed at increasing the mobility and performance of the network, while for solving the problem of neutralizing security threats, not only performance is important, but also the elimination of compromised network nodes, as well as the construction of alternative paths between nodes, the connection between which has been disrupted as a result of the cyber threat. In this case, the specified solution uses a fixed (set) delay threshold. Rebuilding the network infrastructure often leads to the fact that nodes that were previously practically unloaded become loaded and require an update of the latency threshold to ensure an adequate response to changing conditions in the network infrastructure.

The solution to the technical problem posed is provided by the fact that in the method of self-regulation of the network infrastructure of industrial facilities when exposed to security threats, the target function of the industrial facility under consideration is determined, highlighting the set of physical processes of the facility and the set of information functions performed by the nodes of the network infrastructure of the facility, and presenting the target function as a set of functional sequences, then save the objective function as a set of functional sequences into a database located on the database server, then build a graph of the network infrastructure of an industrial facility and save it to the database located on the database server, then generate for each function included in the the objective function, a cluster, which is a set in which all the vertices and subgraphs of the graph capable of performing this function will be collected, build a graph of all possible options for implementing the objective function in the form of a multilevel graph and save it to a database located on the database server, then, using de Bruijn graphs, they obtain sets of links between clusters and operations between clusters in connection with the strict order in the execution and interconnection of functions included in the target, then save the resulting sets of links and operations between clusters to a database located on the database server, then receive a signal from the system or the security threat detection engine about which node of the graph is affected by the impact of the security threat, then determine the list of violated functions that the affected graph node performed, then rebuild the network infrastructure of an industrial facility in such a way as to neutralize the impact of the threat using clusters of functions, sets of connections and operations between clusters, a multi-level graph, then check that the target function is again performed by the nodes.

The network infrastructure is represented in the form of a directed graph, and its objective function (a set of necessary functions of an industrial facility) - in the form of a sequence of interrelated functions associated with the nodes of the graph. The impact of a security threat is represented in the form of a change in the number of nodes and graph arcs, as well as changes in their characteristics. For each function that is part of the target, a cluster is formed - a set of nodes and subgraphs of the graph that are able to perform the same function and replace the device performing the function at the moment, in the event of its failure or compromise as a result of the implementation of a security threat in the form of a violation security.

For the objective function, connections between clusters are specified using de Bruijn graphs. The use of de Bruijn graphs makes it possible to distinguish between different clusters such nodes or subgraphs, the connection between which can be built as quickly as possible, since subgraphs will be found that end (for the first cluster) and begin (for the second) from the same node of the graph, which minimizes the time of connection and execution of both functions, and, therefore, will provide the fastest possible construction of an alternative functional sequence equivalent to the objective function observed before the implementation of the security threat.

The method of self-regulation of the network infrastructure of industrial facilities under the influence of security threats is illustrated by the image of the connection between clusters using the de Bruijn graph (Fig. 1), the general scheme for the implementation of self-regulation of the network infrastructure of an industrial facility (Fig. 2), as well as an example that includes three figures (network graph infrastructure before the impact of a security threat (Fig. 3), building new connections using de Bruijn graphs (Fig. 4), a new graph of the network infrastructure after performing self-regulation (Fig. 5)).

, в результате нарушения безопасности из строя выведен узел, реализующий функцию

. Тогда в результате разрыва функции

остались две последовательности:

и

, для соединения которых необходимо найти нескомпрометированный узел, способный выполнять функцию

и взаимодействовать с узлами, реализующими две оставшиеся последовательности. The consequences of the impact of a security threat in terms of the graph model are presented as discontinuities in the functional sequence of the objective function of an industrial facility. For example, for an object that implements the objective function

, as a result of a security breach, the node that implements the function

... Then, as a result of the discontinuity of the function

there are two sequences left:

and

, for the connection of which it is necessary to find an uncompromised node capable of performing the function

and interact with nodes that implement the remaining two sequences.

позволяет провести аналогию между восстановлением функции

и биоинформационной задачей сборки генома. Способ саморегуляции сетевой инфраструктуры промышленных объектов при воздействии угроз безопасности реализует перенос и адаптацию принципов сборки генома на сетевые инфраструктуры промышленных объектов с использованием математического аппарата графов де Брёйна, обеспечивая повышение скорости их реконфигурации.This function representation

allows you to draw an analogy between the restoration of the function

and the bioinformatics task of genome assembly. The method of self-regulation of the network infrastructure of industrial facilities under the influence of security threats implements the transfer and adaptation of the principles of genome assembly to the network infrastructures of industrial facilities using the mathematical apparatus of de Bruijn graphs, providing an increase in the speed of their reconfiguration.

может быть выполнена либо одиночным устройством, являющимся в терминах графовой модели вершиной

, либо одиночным устройством

, либо путем взаимодействия устройств (в терминах графовой модели – маршрутом на графе):

. Функция

может быть выполнена либо устройством

, либо устройствами (

), либо устройствами

.From the representation of FIG. 1 it follows that the function

can be performed either by a single device, which is a vertex in terms of the graph model

, or a single device

, or through the interaction of devices (in terms of the graph model - a route on the graph):

... Function

can be done either by the device

, or devices (

), or devices

...

Comparison of each of the functions included in the target, the set of options for its implementation is advisable for the following reasons. It is easy to perform at the stage of preparing an industrial facility for operation in an unsafe environment - clustering is extremely fast. The search time in a cluster is many times less than a search with an exhaustive search of vertices in a graph. In addition, in conditions of approximately the same size of all clusters, parallel search will be effective (if a security breach has affected several links in the objective function chain). The representation of the function of an industrial facility in the form of de Bruijn graphs provides the linking of clusters, and it is due to them that more complex functions are obtained, each of which is performed by many devices.

был получен альтернативный вариант ее реализации, необходимо учесть, что до нее выполнялась, например, функция

, а после

будет выполнена

. В таких условиях необходимо, чтобы все узлы сетевой инфраструктуры промышленного объекта, реализующие эти функции, могли взаимодействовать между собой. При этом, поскольку время на поиск, выбор и применение сценария саморегуляции сильно ограничен временем реализации угрозы безопасности, выбирают такие устройства для восстановления функции

, которые позволят организовать более быстрое взаимодействие с устройствами из кластеров других функций.If using a cluster for the broken function

an alternative version of its implementation was obtained, it is necessary to take into account that, for example, the function

, and then

will be done

... In such conditions, it is necessary that all nodes of the network infrastructure of an industrial facility that implement these functions can interact with each other. At the same time, since the time for the search, selection and application of the self-regulation scenario is strongly limited by the time of the implementation of the security threat, such devices are chosen to restore the function.

that will allow you to organize faster interaction with devices from clusters of other functions.

The vertices of the de Bruijn graph are strings of fixed length, and they are connected by an edge when the suffix of the first string is the prefix of the second string. To apply this graph to an industrial facility, the end vertex of each subgraph of the cluster under consideration is associated with a label - a list with which vertices it can interact with. And when choosing a recovery method, functions are guided by those vertices from which the execution of a function from a neighboring cluster begins.

и

была нарушена связь, вследствие чего не была выполнена функция

, то в кластере для функции

находят альтернативные пути ее реализации. Важным условием является выбор такого маршрута, при котором устройства из разных кластеров смогут взаимодействовать, и время выполнения нового маршрута будет минимальным.If between the peaks

and

communication was broken, as a result of which the function was not performed

, then in the cluster for the function

find alternative ways to implement it. An important condition is the choice of a route in which devices from different clusters will be able to interact, and the execution time of a new route will be minimal.

Let each vertex be characterized by three symbols (designations of vertices): the first symbol denotes a vertex that begins to perform the function, the second symbol denotes a vertex that ends the execution of the function, and the third symbol denotes a vertex not from a cluster with which the considered vertex is adjacent. If a vertex is designated by two symbols, it means that the function under consideration is performed by one device (the same one that is in the first place in the name of the vertex).

The use of the de Bruijn Count allows you to quickly select a suitable scenario for self-regulation. The general scheme for implementing self-regulation of the network infrastructure of an industrial facility is shown in Fig. 2. Self-regulation of the network infrastructure of industrial facilities is implemented as follows:

1. Determine the sequences of functions for which the route is to be restored. Each of the sequences begins with a function that can be implemented without re-routing. An exception is the case when a complete restoration of the route of the entire objective function is required.

:2. For each sequence

:

2.1. The construction of an auxiliary graph is carried out according to the following rules:

;each layer of the graph is responsible for performing one of the functions in the sequence

;

the layers in the graph are placed in the same order as the corresponding functions in the sequence;

включает множество вершин и последовательностей вершин, принадлежащих кластеру, соответствующему функции

;each layer

includes a set of vertices and sequences of vertices belonging to the cluster corresponding to the function

;

between all adjacent layers, except for the first and second, edges are constructed according to the principle of building edges in the de Bruijn graph.

в текущем состоянии маршрута. Обозначают данную вершину (или, в случае выбора последовательности, последнюю вершину в последовательности) как

. Далее создают ребра между вершиной

и некоторыми вершинами второго слоя: между одиночными вершинами, которые в графе являются соседями

, и между вершинами, которые являются соседями

в исходном графе и с которых начинается последовательность вершин. В том случае, когда требуется восстановить маршрут всей целевой функции, ребра между всеми слоями строят по принципу построения ребер в графе де Брейна, первый и второй слои не являются исключением.2.2. From all vertices and sequences of vertices of the first layer, select that vertex or sequence of vertices that implements the function

in the current state of the route. This vertex (or, in the case of a sequence selection, the last vertex in the sequence) is denoted as

... Next, create the edges between the vertex

and some vertices of the second layer: between single vertices that are neighbors in the graph

, and between vertices that are neighbors

in the original graph and from which the sequence of vertices begins. In the case when it is required to restore the route of the entire objective function, the edges between all layers are built according to the principle of constructing edges in the de Bruijn graph, the first and second layers are no exception.

– множество вершин, достижимых из первого слоя;

– множество вершин, ведущих к тупиковым путям.This step also creates two empty sets:

- the set of vertices reachable from the first layer;

- many peaks leading to dead-end paths.

2.3. Until a route is found or until it turns out that there are no suitable routes, the following actions are performed:

2.3.1. Searches for paths connecting the first and last layers.

. Если какая-либо из вершин последнего слоя помечается, то маршрут найден. Переходят к следующей последовательности.1) Mark the set of reachable vertices (with reference to the layer in which they are located) using depth-first or breadth-first search, starting from the vertex

... If any of the vertices of the last layer is marked, then the route is found. Move on to the next sequence.

2) Choose the longest path starting from the first layer and not containing dead-end vertices or sequences of vertices. The length of a path is measured by the number of layers through which a given path passes.

. Соединяют вершину

c вершиной следующего слоя, если эта одиночная вершина, которая в графе является соседней с

и не принадлежит множеству тупиковых вершин; или с этой вершины начинается последовательность вершин, не являющейся тупиковой, и эта вершина является соседней с вершиной

в исходном графе.3) Designate the last vertex in this path as

... Connect the top

with the vertex of the next layer, if this single vertex, which in the graph is adjacent to

and does not belong to the set of dead-end vertices; or from this vertex begins a sequence of vertices that is not a dead end, and this vertex is adjacent to the vertex

in the original graph.

4) If a vertex cannot be connected to any of the vertices of the next layer, the vertex is transferred from the set of reachable vertices to the set of dead ends.

5) Return to step 1), marking the set of reachable vertices.

, строят ребра между первым и вторым слоями графа, строят дополнительные ребра между вторым и третьим слоем. При этом не строят ребра между остальными слоями, поскольку они уже построены ранее. Если новый слой добавить невозможно (это происходит, когда на предыдущем шаге уже был добавлен слой), соответствующий началу целевой функции, то далее действия не осуществляют, так как без внесения дополнительных модификаций в исходный граф восстановить маршрут нельзя.2.3.2. If the path was not found, one more layer is added to the left of the graph, corresponding to the function preceding the current sequence of functions under consideration. The numbering of the layers is shifted (the first becomes the second, etc.). According to the principle indicated in step 2.2, a new vertex is selected

, build edges between the first and second layers of the graph, build additional edges between the second and third layers. At the same time, they do not build edges between the rest of the layers, since they have already been built earlier. If it is impossible to add a new layer (this happens when a layer has already been added in the previous step) corresponding to the beginning of the objective function, then no further actions are performed, since the route cannot be restored without additional modifications to the original graph.

3. Combine the discovered routes.

. В результате воздействия угрозы безопасности, заключающейся в выведении из строя трех компонентов (

), выполнена саморегуляция с использованием графа, представленного на фиг. 4. Новое графовое представление и новый маршрут реализации целевой функции представлены на фиг. 5.FIG. 3 shows an example of a graph that simulates the analysis subsystem of an energy industrial facility. The dotted arrows represent the objective function

... As a result of the impact of a security threat, consisting in the incapacitation of three components (

), self-regulation was performed using the graph shown in Fig. 4. The new graphical representation and the new route of the objective function implementation are presented in FIG. 5.

As a result, for any type of security threat, at its first manifestation in the network, self-regulation of the network infrastructure of industrial facilities is initiated when exposed to security threats. Due to the saved graph representation of the objective function, the formed clusters for each function and the saved de Bruijn graphs for the connections between the clusters, a solution is quickly found that allows you to restore the broken function that is part of the objective function. The method allows you to rebuild the network infrastructure faster than a security breach develops, and thereby increase the security and stability of industrial facilities.

Claims (1)

A method of self-regulation of the network infrastructure of industrial facilities when exposed to security threats, including rebuilding the network upon receipt of a signal from a module or a security threat detection system located on a separate computer, characterized in that for the network infrastructure of an industrial facility, it is preformed and saved to databases located on the server databases, a set of functional sequences characterizing the target function of an industrial facility, a graphical representation of the network infrastructure of an industrial facility, sets of links and operations between clusters of each function from a set of functional sequences obtained using de Bruijn graphs, a multilevel graph representing all possible options for implementing the target function , then when receiving a signal from a module or a security threat detection system located on a separate computer, about which node of the graph is affected by a network attack, a list of violated functions from a set of functional sequences, search for clusters of functions stored in databases, sets of links and operations between clusters, a multi-level graph of options for rebuilding the network structure, then choose the fastest option for rebuilding the network structure to apply and apply to the current network structure, then check the fact that the target function is again performed by the nodes of the network infrastructure.

Images