A Distributed Platform for Security Event Handling in Industrial Control Networks

Bibliographic Details
Main Author: Toledo, Leonardo Micael Freitas
Publication Date: 2018
Format: Master thesis
Language: eng
Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
Download full: https://hdl.handle.net/10316/83563
Summary: Dissertação de Mestrado em Engenharia Informática apresentada à Faculdade de Ciências e Tecnologia
id RCAP_d7b10308a89d91859e4ff0e36f232978
oai_identifier_str oai:estudogeral.uc.pt:10316/83563
network_acronym_str RCAP
network_name_str Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
repository_id_str https://opendoar.ac.uk/repository/7160
spelling A Distributed Platform for Security Event Handling in Industrial Control NetworksUma Plataforma Distribuída para Tratamento de Eventos de Segurança em Redes de Controlo IndustrialIntrusion Anomaly Detection System (IADS)Industrial Automation and Control System (IACS)Industrial Control Network (ICN)Supervisory Control and Data Acquisition (SCADA)Security Information and Event Management (SIEM)Intrusion Anomaly Detection System (IADS)Industrial Automation and Control System (IACS)Industrial Control Network (ICN)Supervisory Control and Data Acquisition (SCADA)Security Information and Event Management (SIEM)Dissertação de Mestrado em Engenharia Informática apresentada à Faculdade de Ciências e TecnologiaDurante os últimos anos, os Industrial Automation and Control Systems (IACSes) tornaram-se mais distribuídos. A actual idade de Big Data e Internet of Things (IoT) também trouxe novos desafios, como tratar grandes quantidades de dados heterogéneos em tempo-real. Sem soluções eficientes e escaláveis para processamento de todos os eventos gerados por cada fonte de dados (como um componente de deteção segurança ou sensores de telemetria), muitas informações valiosas podem se perder ou não serem detetadas a tempo. Sistemas de Security Information and Event Management (SIEM), que são ferramentas dedicadas responsáveis por processar e gerir adequadamente eventos de segurança, são portanto um componente crítico na segurança de um IACS. Tipicamente os sistemas SIEM são caros, não tem flexibilidade de personalização ou não são totalmente personalizados para ambientes distribuídos e abordagens Big Data. Para abordar essas questões, neste trabalho é proposto, projetado e implementado, uma plataforma eficiente para processar eventos provenientes de várias fontes, capaz de escalar facilmente de acordo com as necessidades do IACS, capaz de efectuar pre-processamento por domínio, bem como, análises globais (streaming e batch), no topo dos eventos de segurança. Além disto, a plataforma proposta é distribuída e permite geo-replicação de dados. Mais ainda, esta usa tecnologias actuais, open-source, como forma de melhorar o tratamento dos eventos de segurança em Industrial Control Networks (ICNs), e envolver a comunidade open-source a trabalhar numa solução comum para este problema.During the past few years, Industrial Automation and Control Systems (IACSes) have become more distributed. The current age of Big Data and the Internet of Things (IoT) also brings new challenges to these systems, like the need to handle large amounts of heterogeneous data in real-time. Without efficient and scalable solutions for processing all the events generated by each data source (such as security related detection components or telemetry sensors), a lot of valuable insights may get lost or not be detected on time. Security Information and Event Management (SIEM) systems, which are dedicated tools responsible for properly processing and managing security related events, are therefore critical components for the security and safety of an IACS. Typical SIEM systems are expensive, lack customization flexibility or are not fully optimized for distributed environments and big data processing approaches. To address those issues, in this work is proposed, designed, and implemented an efficient framework for processing events coming from several sources, able to easily scale according to the IACS needs, capable of performing per-domain pre-processing, as well as global stream and batch analysis, on the top of security events. Furthermore, the proposed framework is distributed and allows geo-replication of data. Moreover, it uses cutting-edge open-source technologies as a way to advance security event handling in Industrial Control Networks (ICs), and to involve the open-source community in working towards a common solution to this problem.2018-02-05info:eu-repo/semantics/publishedVersioninfo:eu-repo/semantics/masterThesishttps://hdl.handle.net/10316/83563https://hdl.handle.net/10316/83563TID:202129764engmetadata only accessinfo:eu-repo/semantics/openAccessToledo, Leonardo Micael Freitasreponame:Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)instname:FCCN, serviços digitais da FCT – Fundação para a Ciência e a Tecnologiainstacron:RCAAP2021-06-15T10:58:16Zoai:estudogeral.uc.pt:10316/83563Portal AgregadorONGhttps://www.rcaap.pt/oai/openaireinfo@rcaap.ptopendoar:https://opendoar.ac.uk/repository/71602025-05-29T05:30:00.857709Repositórios Científicos de Acesso Aberto de Portugal (RCAAP) - FCCN, serviços digitais da FCT – Fundação para a Ciência e a Tecnologiafalse
dc.title.none.fl_str_mv A Distributed Platform for Security Event Handling in Industrial Control Networks
Uma Plataforma Distribuída para Tratamento de Eventos de Segurança em Redes de Controlo Industrial
title A Distributed Platform for Security Event Handling in Industrial Control Networks
spellingShingle A Distributed Platform for Security Event Handling in Industrial Control Networks
Toledo, Leonardo Micael Freitas
Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
title_short A Distributed Platform for Security Event Handling in Industrial Control Networks
title_full A Distributed Platform for Security Event Handling in Industrial Control Networks
title_fullStr A Distributed Platform for Security Event Handling in Industrial Control Networks
title_full_unstemmed A Distributed Platform for Security Event Handling in Industrial Control Networks
title_sort A Distributed Platform for Security Event Handling in Industrial Control Networks
author Toledo, Leonardo Micael Freitas
author_facet Toledo, Leonardo Micael Freitas
author_role author
dc.contributor.author.fl_str_mv Toledo, Leonardo Micael Freitas
dc.subject.por.fl_str_mv Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
topic Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
Intrusion Anomaly Detection System (IADS)
Industrial Automation and Control System (IACS)
Industrial Control Network (ICN)
Supervisory Control and Data Acquisition (SCADA)
Security Information and Event Management (SIEM)
description Dissertação de Mestrado em Engenharia Informática apresentada à Faculdade de Ciências e Tecnologia
publishDate 2018
dc.date.none.fl_str_mv 2018-02-05
dc.type.status.fl_str_mv info:eu-repo/semantics/publishedVersion
dc.type.driver.fl_str_mv info:eu-repo/semantics/masterThesis
format masterThesis
status_str publishedVersion
dc.identifier.uri.fl_str_mv https://hdl.handle.net/10316/83563
https://hdl.handle.net/10316/83563
TID:202129764
url https://hdl.handle.net/10316/83563
identifier_str_mv TID:202129764
dc.language.iso.fl_str_mv eng
language eng
dc.rights.driver.fl_str_mv metadata only access
info:eu-repo/semantics/openAccess
rights_invalid_str_mv metadata only access
eu_rights_str_mv openAccess
dc.source.none.fl_str_mv reponame:Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
instname:FCCN, serviços digitais da FCT – Fundação para a Ciência e a Tecnologia
instacron:RCAAP
instname_str FCCN, serviços digitais da FCT – Fundação para a Ciência e a Tecnologia
instacron_str RCAAP
institution RCAAP
reponame_str Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
collection Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
repository.name.fl_str_mv Repositórios Científicos de Acesso Aberto de Portugal (RCAAP) - FCCN, serviços digitais da FCT – Fundação para a Ciência e a Tecnologia
repository.mail.fl_str_mv info@rcaap.pt
_version_ 1833602375920648192

Similar Items