<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01614870</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T23:26:44+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Lightweight Journaling for Scada Systems via Event Correlation</title>
            <author role="aut">
              <persName>
                <forename type="first">Antoine</forename>
                <surname>Lemay</surname>
              </persName>
              <email type="md5">ab7934009a2f43103792d5db8bcd9e32</email>
              <email type="domain">live.ca</email>
              <idno type="idhal" notation="numeric">1020653</idno>
              <idno type="halauthorid" notation="string">1248807-1020653</idno>
              <affiliation ref="#struct-57241"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Alireza</forename>
                <surname>Sadighian</surname>
              </persName>
              <idno type="halauthorid">1248808-0</idno>
              <affiliation ref="#struct-57241"/>
              <affiliation ref="#struct-519841"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jose</forename>
                <surname>Fernandez</surname>
              </persName>
              <idno type="halauthorid">983758-0</idno>
              <affiliation ref="#struct-57241"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2017-10-11 15:00:07</date>
              <date type="whenModified">2018-03-19 22:38:02</date>
              <date type="whenReleased">2017-10-11 15:01:12</date>
              <date type="whenProduced">2016-03-14</date>
              <date type="whenEndEmbargoed">2019-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01614870v1/document">
                <date notBefore="2019-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01614870v1/file/434671_1_En_6_Chapter.pdf" id="file-1614870-1656977">
                <date notBefore="2019-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01614870</idno>
            <idno type="halUri">https://inria.hal.science/hal-01614870</idno>
            <idno type="halBibtex">lemay:hal-01614870</idno>
            <idno type="halRefHtml">&lt;i&gt;10th International Conference on Critical Infrastructure Protection (ICCIP)&lt;/i&gt;, Mar 2016, Arlington, VA, United States. pp.99-115, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-48737-3_6"&gt;&amp;#x27E8;10.1007/978-3-319-48737-3_6&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">10th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2016, Arlington, VA, United States. pp.99-115, &amp;#x27E8;10.1007/978-3-319-48737-3_6&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1614870-1656977"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-ICCIP" corresp="IFIP-AICT">IFIP-ICCIP</idno>
            <idno type="stamp" n="IFIP-WG11-10" corresp="IFIP-AICT">IFIP-WG11-10</idno>
            <idno type="stamp" n="IFIP-AICT-485" corresp="IFIP-AICT">Critical Infrastructure Protection X</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 2: CONTROL SYSTEMS SECURITY</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Lightweight Journaling for Scada Systems via Event Correlation</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Antoine</forename>
                    <surname>Lemay</surname>
                  </persName>
                  <email type="md5">ab7934009a2f43103792d5db8bcd9e32</email>
                  <email type="domain">live.ca</email>
                  <idno type="idhal" notation="numeric">1020653</idno>
                  <idno type="halauthorid" notation="string">1248807-1020653</idno>
                  <affiliation ref="#struct-57241"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Alireza</forename>
                    <surname>Sadighian</surname>
                  </persName>
                  <idno type="halauthorid">1248808-0</idno>
                  <affiliation ref="#struct-57241"/>
                  <affiliation ref="#struct-519841"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jose</forename>
                    <surname>Fernandez</surname>
                  </persName>
                  <idno type="halauthorid">983758-0</idno>
                  <affiliation ref="#struct-57241"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>10th International Conference on Critical Infrastructure Protection (ICCIP)</title>
                  <date type="start">2016-03-14</date>
                  <date type="end">2016-03-16</date>
                  <settlement>Arlington, VA</settlement>
                  <country key="US">United States</country>
                </meeting>
                <imprint>
                  <biblScope unit="serie">Critical Infrastructure Protection X</biblScope>
                  <biblScope unit="volume">AICT-485</biblScope>
                  <biblScope unit="pp">99-115</biblScope>
                  <date type="datePub">2016</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-48737-3_6</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Event correlation</term>
                <term xml:lang="en">Journaling</term>
                <term xml:lang="en">Network forensics</term>
                <term xml:lang="en">SCADA Networks</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Industrial control systems are not immune to cyber incidents. However, the support for incident responders and forensic investigators is low. In particular, there are limited journaling capabilities for operator actions. Barring the preservation of full packet captures and operator workstation security logs, which can generate unmanageable amounts of data on production networks, it is generally not possible to attribute control events (e.g., opening a valve or operating a breaker) to individual operators. This information can be necessary to perform security investigations, especially in cases involving malicious insider activities. This chapter presents a lightweight journaling system for SCADA networks based on event correlation. By correlating network events and operating system logs, a journal is generated of all Modbus protocol write events along with the usernames of the operators who performed the actions. The journal is much more compact than a full packet capture, achieving compression ratios of around 570 to 1 in conservative conditions and more than 2,000 to 1 in typical operating conditions, allowing for the preservation of valuable information for security investigations.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
              <org type="consortium">WG 11.10</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-57241" status="VALID">
          <idno type="ROR">https://ror.org/05f8d4e86</idno>
          <orgName>École Polytechnique de Montréal</orgName>
          <orgName type="acronym">EPM</orgName>
          <desc>
            <address>
              <addrLine>Campus de l'Université de Montréal - 2500, chemin de Polytechnique - Montréal (Québec) H3T 1J4</addrLine>
              <country key="CA"/>
            </address>
            <ref type="url">http://www.polymtl.ca/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-519841" status="VALID">
          <orgName>Groupe Access</orgName>
          <desc>
            <address>
              <country key="CA"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>