A Distributed Real-Time Event Correlation Architecture for SCADA Security - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2013

A Distributed Real-Time Event Correlation Architecture for SCADA Security

Résumé

Supervisory control and data acquisition (SCADA) systems require real-time threat monitoring and early warning systems to identify cyber attacks. Organizations typically employ intrusion detection systems to identify attack events and to provide situational awareness. However, as cyber attacks become more sophisticated, intrusion detection signatures of single events are no longer adequate. Indeed, effective intrusion detection solutions require the correlation of multiple events that are temporally and/or spatially separated. This paper proposes an innovative event correlation mechanism for cyber threat detection, which engages a semantic event hierarchy. Cyber attacks are specified via low-level events detected in the communications and computing infrastructure and correlated to identify attacks of a broader scope. The paper also describes a distributed architecture for real-time event capture, correlation and dissemination. The architecture employs a publish/subscribe mechanism, which decentralizes limited computing resources to distributed field agents in order to enhance real-time attack detection while limiting unnecessary communications overhead.
Fichier principal
Vignette du fichier
978-3-642-45330-4_6_Chapter.pdf (2.72 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01456894 , version 1 (06-02-2017)

Licence

Paternité

Identifiants

Citer

Yi Deng, Sandeep Shukla. A Distributed Real-Time Event Correlation Architecture for SCADA Security. 7th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2013, Washington, DC, United States. pp.81-93, ⟨10.1007/978-3-642-45330-4_6⟩. ⟨hal-01456894⟩
65 Consultations
453 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More