A Distributed Real-Time Event Correlation Architecture for SCADA Security - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2013

A Distributed Real-Time Event Correlation Architecture for SCADA Security


Supervisory control and data acquisition (SCADA) systems require real-time threat monitoring and early warning systems to identify cyber attacks. Organizations typically employ intrusion detection systems to identify attack events and to provide situational awareness. However, as cyber attacks become more sophisticated, intrusion detection signatures of single events are no longer adequate. Indeed, effective intrusion detection solutions require the correlation of multiple events that are temporally and/or spatially separated. This paper proposes an innovative event correlation mechanism for cyber threat detection, which engages a semantic event hierarchy. Cyber attacks are specified via low-level events detected in the communications and computing infrastructure and correlated to identify attacks of a broader scope. The paper also describes a distributed architecture for real-time event capture, correlation and dissemination. The architecture employs a publish/subscribe mechanism, which decentralizes limited computing resources to distributed field agents in order to enhance real-time attack detection while limiting unnecessary communications overhead.
Fichier principal
Vignette du fichier
978-3-642-45330-4_6_Chapter.pdf (2.72 Mo) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01456894 , version 1 (06-02-2017)





Yi Deng, Sandeep Shukla. A Distributed Real-Time Event Correlation Architecture for SCADA Security. 7th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2013, Washington, DC, United States. pp.81-93, ⟨10.1007/978-3-642-45330-4_6⟩. ⟨hal-01456894⟩
65 View
445 Download



Gmail Facebook X LinkedIn More