标题： ICSTrace：工业控制系统攻击数据的恶意IP追溯模型 显示英文标题

标题： ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System

摘要： 考虑到针对工业控制系统攻击大多是组织性和预谋性的行动，IP追溯对于工业控制系统的安全性至关重要。 基于互联网基础设施，我们开发了一个新颖的恶意IP追溯模型-ICSTrace，无需部署任何新服务。 该模型根据工业控制协议的格式从攻击数据中提取功能代码及其参数，并采用短序列概率方法将功能代码及其参数转换为向量，该向量描述了恶意IP地址的攻击模式。 此外，提出了一种部分种子K均值算法用于模式聚类，有助于将攻击追溯到一个组织。 ICSTrace基于工业控制系统大规模部署的蜜罐捕获的攻击数据进行评估，结果表明ICSTrace在工业控制系统的恶意IP追溯方面是有效的。 显示英文摘要

摘要： Considering the attacks against industrial control system are mostly organized and premeditated actions, IP traceback is significant for the security of industrial control system. Based on the infrastructure of the Internet, we have developed a novel malicious IP traceback model-ICSTrace, without deploying any new services. The model extracts the function codes and their parameters from the attack data according to the format of industrial control protocol, and employs a short sequence probability method to transform the function codes and their parameter into a vector, which characterizes the attack pattern of malicious IP addresses. Furthermore, a Partial Seeded K-Means algorithm is proposed for the pattern's clustering, which helps in tracing the attacks back to an organization. ICSTrace is evaluated basing on the attack data captured by the large-scale deployed honeypots for industrial control system, and the results demonstrate that ICSTrace is effective on malicious IP traceback in industrial control system.