基于容器的轻量级工业控制系统网络安全测试床研究

针对现有工业控制系统(ICS)测试床部署成本高、网络拓扑简单固定、难以共享等问题,提出了一种基于容器的轻量级ICS网络安全测试床构建方法。该方法将田纳西—伊斯曼过程模型及其控制算法分别封装为两类Docker容器镜像,根据Web图形化界面绘制工业控制网络拓扑,自动配置容器接口并连接成仿真工控网络,最终实现具有真实的工业控制网络数据流的ICS网络安全测试床。实验结果表明,该方法仅需要较少的系统资源,就可快速实现给定网络拓扑的测试环境,支持多种网络攻击测试,相比于其他ICS测试床,具有更好的资源使用、加载速度和可移植性,有利于ICS网络安全的测试、研究和教学工作。

Research on lightweight ICS cyber security testbed based on container

Aiming at the problems of high cost of deployment,simple and fixed network topology,and difficulty in sharing of existing industrial control system(ICS)testbed,this paper proposed a container-based lightweight ICS cybersecurity testbed construction method.This method packaged the Tennessee-Eastman process model and its control algorithm into two Docker container images,drawn the industrial control network topology according to the Web graphical interface,configured and connected the container interface to the simulation industrial control network automatically.Finally,it realized a lightweight ICS cybersecurity testbed with real industrial control network data flow.Experimental results show that this method can quickly realize the test environment of given network topology with fewer system resources and support a variety of network attack tests.Compared with other ICS testbeds,it has better resource use,load speed and portability,which is beneficial to the testing,research and teaching of ICS cybersecurity.