Apparatus and method for identifying web page for industrial control system

• US 10,416,654 B2
• Filed: 06/17/2015
• Issued: 09/17/2019
• Est. Priority Date: 08/29/2014
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Jeon, Sungho, Yun, Jeong-Han, Kim, Woonyon, Park, Eung Ki, Park, Sangwoo
• Primary Examiner(s): Burke, Jeff A
• Assistant Examiner(s): Vu, Thong H
• Application Number:
  US14/741,529
• Publication Number:
  US 20160062344A1
• Time in Patent Office: 1,553 Days
• Field of Search: 707706, 726 2, 726 25, 705 39
• CPC Class Codes: G05B 19/408 characterised by data handling or data format, e.g. reading, buffering or conversion of data
• CPC Class Codes: G05B 19/409 characterised by using manual data input [MDI] or by using control panel, e.g. controlling functions with the panel; characterised by control panel details or by setting parameters G05B19/408, G05B19/4093 take precedence
• CPC Class Codes: G05B 2219/34444 Web control system, with intelligent control components each with web server
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An apparatus for identifying a web page for an industrial control system includes an information collection unit and an industrial control system identification unit. The information collection unit receives IP targets, from which web pages are to be collected, from a user, and collects web pages and information from the IP targets. The industrial control system identification unit identifies web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit.

Claims

1. An apparatus for identifying a web page for an industrial control system, comprising:

an information collection unit configured to receive IP targets, from which web pages are to be collected, from a user and to collect web pages and information from the IP targets; and

an industrial control system identification unit configured to identify web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit,

wherein the industrial control system identification unit identifies a type of each of the web pages for the industrial control systems with respect to the IP targets via N identification characteristics and M identification models,

wherein the identification characteristics comprise whether an external source is used, similarity comparison, WHOIS, web page content, simple login type, and monitoring type, and

wherein the similarity comparison comprises comparison of the web page with a collected web page provided by a manufacturer and a result value of similarity depends on a provided threshold value.

2. The apparatus of claim 1, wherein the identification models comprise type 1, type 2, and, type 3.

3. The apparatus of claim 2, wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 1 if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

similarity”

in examination of similarity comparison, and a result value indicative of a “

pass”

in examination of WHOIS.

4. The apparatus of claim 3, wherein type 1 corresponds to a case where each of the web pages for the industrial control systems is very similar to a web page provided by an industrial control system device manufacturer.

5. The apparatus of claim 2, wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 2 if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

dissimilarity”

in examination of similarity comparison, a result value indicative of “

being suspected to be a control system”

in examination of web page content, and a result value indicative of “

simple login type (YES)”

in examination of simple login type.

6. The apparatus of claim 5, wherein type ‘

2 corresponds to a case where each of the web pages for the industrial control systems has a keyword, making the web page suspected to be a web page for an industrial control system, and has a very simple administrator login form.

7. The apparatus of claim 2, wherein the industrial control system identification unit classifies each of the web pages for the industrial control systems with respect to the IP targets as type 3 if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

dissimilarity”

in examination of similarity comparison, a result value indicative of “

being suspected to be a control system”

in examination of web page content, a result value indicative of “

a non-simple login type (NO)”

in examination of simple login type, and a result value indicative of “

monitoring type (YES)”

in examination of monitoring type.

8. The apparatus of claim 7, wherein type 3 corresponds to a case where a web page has a keyword, making the web page suspected to be a web page for an industrial control system, and corresponds to a field device state and system state monitoring web page.

9. A method of identifying a web page for an industrial control system, comprising:

receiving, by an information collection unit, IP targets, from which web pages are to be collected, from a user, and collecting, by the information collection unit, web pages and information from the IP targets; and

identifying, by an industrial control system identification unit, web pages for one or more industrial control systems with respect to the IP targets based on the information collected by the information collection unit,

wherein identifying the web pages for the industrial control systems comprises identifying a type of each of the web pages for the industrial control systems with respect to the IP targets via N identification characteristics and M identification models,

wherein the identification characteristics comprise whether an external source is used, similarity comparison, WHOIS, web page content, simple login type, and monitoring type, and

wherein the similarity comparison comprises comparison of the web page with a collected web page provided by a manufacturer and a result value of similarity depends on a provided threshold value.

10. The method of claim 9, wherein the identification models comprise type 1, type 2, and type 3.

11. The method of claim 10, wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type I if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

similarity”

in examination of similarity comparison, and a result value indicative of a “

pass”

in examination of WHOIS.

12. The method of claim 11, wherein type 1 corresponds to a case where each of the web pages for the industrial control systems is very similar to a web page provided by an industrial control system device manufacturer.

13. The method of claim 10, wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type 2 if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

dissimilarity”

in examination of similarity comparison, a result value indicative of “

being suspected to be a control system”

in examination of web page content, and a result value indicative of “

simple login type (YES)”

in examination of simple login type.

14. The method of claim 13, wherein type 2 corresponds to a case where each of the web pages for the industrial control systems has a keyword, making the web page suspected to be a web page for an industrial control system, and has a very simple administrator login form.

15. The method of claim 10, wherein identifying the web pages for the industrial control systems comprises classifying each of the web pages for the industrial control systems with respect to the IP targets as type 3 if the industrial control system identification unit obtains a result value indicating that “

an external source is not used”

in examination of whether an external source is used, a result value indicative of “

dissimilarity”

in examination of similarity comparison, a result value indicative of “

being suspected to be a control system”

in examination of web page content, a result value indicative of “

a non-simple login type (NO)”

in examination of simple login type, and, a result value indicative of “

monitoring type (YES)”

in examination of monitoring type.

16. The method of claim 15, wherein type 3 corresponds to a case where a web page has a keyword, making the web page suspected to be a web page for an industrial control system, and corresponds to a field device state and system state monitoring web page.