Trust Conditions for Active Scanning Methods for Finding Vulnerabilities in ICS Networks

Active scanning methods are increasingly used in intrusion detection systems (IDS) to collect and analyze network information. Since active scanning requires a response from network devices, it can affect the stability of network equipment, which is critical for the operation of industrial networks. Currently, there are few studies on the impact of active scanning methods on the stability of the operation of networks of industrial control systems (ICS). Therefore, an important question is whether one or another method of active scanning can be trusted and applied when scanning ICS networks. The paper considers the main methods of active scanning of ICS networks, describes the algorithms for their implementation. In the presented example, as a result of applying active scanning methods, a UML diagram of the assets of the ICS network was built. The trust conditions applied to active scanning methods are formulated, which allow developing secure methods for collecting and analyzing network information to build a verified active scanning system to search for vulnerabilities in ICS networks.