Apparatus and method for identifying web page for industrial control system

Patent metadata

Field	Value
Publication number	US-10416654-B2
Application number	US-201514741529-A
Country	US
Kind code	B2
Filing date	Jun 17, 2015
Priority date	Aug 29, 2014
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

An apparatus for identifying a web page for an industrial control system includes an information collection unit and an industrial control system identification unit. The information collection unit receives IP targets, from which web pages are to be collected, from a user, and collects web pages and information from the IP targets. The industrial control system identification unit identifies web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit.

First claim

What is claimed is:

1. An apparatus for identifying a web page for an industrial control system, comprising:
an information collection unit configured to receive IP targets, from which web pages are to be collected, from a user and to collect web pages and information from the IP targets; and
an industrial control system identification unit configured to identify web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit,
wherein the industrial control system identification unit identifies a type of each of the web pages for the industrial control systems with respect to the IP targets via N identification characteristics and M identification models,
wherein the identification characteristics comprise whether an external source is used, similarity comparison, WHOIS, web page content, simple login type, and monitoring type, and
wherein the similarity comparison comprises comparison of the web page with a collected web page provided by a manufacturer and a result value of similarity depends on a provided threshold value.

2. The apparatus of claim 1 , wherein the identification models comprise type 1, type 2, and, type 3.

3. The apparatus of claim 2 , wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 1 if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “similarity” in examination of similarity comparison, and a result value indicative of a “pass” in examination of WHOIS.

4. The apparatus of claim 3 , wherein type 1 corresponds to a case where each of the web pages for the industrial control systems is very similar to a web page provided by an industrial control system device manufacturer.

5. The apparatus of claim 2 , wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 2 if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “dissimilarity” in examination of similarity comparison, a result value indicative of “being suspected to be a control system” in examination of web page content, and a result value indicative of “simple login type (YES)” in examination of simple login type.

6. The apparatus of claim 5 , wherein type ‘ 2 corresponds to a case where each of the web pages for the industrial control systems has a keyword, making the web page suspected to be a web page for an industrial control system, and has a very simple administrator login form.

7. The apparatus of claim 2 , wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 3 if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “dissimilarity” in examination of similarity comparison, a result value indicative of “being suspected to be a control system” in examination of web page content, a result value indicative of “a non-simple login type (NO)” in examination of simple login type, and a result value indicative of “monitoring type (YES)” in examination of monitoring type.

8. The apparatus of claim 7 , wherein type 3 corresponds to a case where a web page has a keyword, making the web page suspected to be a web page for an industrial control system, and corresponds to a field device state and system state monitoring web page.

9. A method of identifying a web page for an industrial control system, comprising:
receiving, by an information collection unit, IP targets, from which web pages are to be collected, from a user, and collecting, by the information collection unit, web pages and information from the IP targets; and
identifying, by an industrial control system identification unit, web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit,
wherein identifying the web pages for the industrial control systems comprises identifying a type of each of the web pages for the industrial control systems with respect to the IP targets via N identification characteristics and M identification models,
wherein the identification characteristics comprise whether an external source is used, similarity comparison, WHOIS, web page content, simple login type, and monitoring type, and
wherein the similarity comparison comprises comparison of the web page with a collected web page provided by a manufacturer and a result value of similarity depends on a provided threshold value.

10. The method of claim 9 , wherein the identification models comprise type 1, type 2, and type 3.

11. The method of claim 10 , wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type I if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “similarity” in examination of similarity comparison, and a result value indicative of a “pass” in examination of WHOIS.

12. The method of claim 11 , wherein type 1 corresponds to a case where each of the web pages for the industrial control systems is very similar to a web page provided by an industrial control system device manufacturer.

13. The method of claim 10 , wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type 2 if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “dissimilarity” in examination of similarity comparison, a result value indicative of “being suspected to be a control system” in examination of web page content, and a result value indicative of “simple login type (YES)” in examination of simple login type.

14. The method of claim 13 , wherein type 2 corresponds to a case where each of the web pages for the industrial control systems has a keyword, making the web page suspected to be a web page for an industrial control system, and has a very simple administrator login form.

15. The method of claim 10 , wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type 3 if the industrial control system identification unit obtains a result value indicating that “an external source is not used” in examination of whether an external source is used, a result value indicative of “dissimilarity” in examination of similarity comparison, a result value indicative of “being suspected to be a control system” in examination of web page content, a result value indicative of “a non-simple login type (NO)” in examination of simple login type, and, a result value indicative of “monitoring type (YES)” in examination

Assignees

• Electronics & Telecommunications Res Inst
• Electronics And Telecommuications Res Institute

Inventors

• Jeon Sungho
• Yun Jeong-Han
• Kim Woonyon
• Park Eung Ki
• Park Sangwoo

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G05B2219/34444

  Web control system, with intelligent control components each with web server · CPC title

• G05B19/409 Primary

  characterised by using manual data input [MDI] or by using control panel, e.g. controlling functions with the panel; characterised by control panel details or by setting parameters (G05B19/408, G05B19/4093 take precedence) · CPC title

• G05B19/408

  characterised by data handling or data format, e.g. reading, buffering or conversion of data · CPC title

• H04L12/22 Primary

  Arrangements for preventing the taking of data from a data transmission channel without authorisation (means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32) · CPC title