Intrusion Detection | Emmanuele Zambon @ TU/e

DEPICT

Mon, 01 Jan 2018 00:00:00 +0000

Protecting Industrial Control Systems (ICS) requires solutions that not disturb existing operations, which is essential for large-scale systems and, especially for legacy systems. In this project we aim to create new tools, algorithms, and software to improve the situational awareness of security analysts for control systems. By combining external threat sources with information extraction through network analysis, and semantics-aware network-based monitoring we will build and maintain models of different perspectives of the system to help security analysts and operators better understand their systems and identify threats, and promptly react to mitigate the impact of attacks.

Our final goal is to leverage and -add intelligence to- deep-packet inspection (DPI) tools to extract knowledge of an ICS and build -actionability-, that is, the ability to act upon present (or future) threats, allowing for, (1) Corrective measures, facilitating early incident response by security analysts without a deep knowledge of ICS, and control-room operators without deep knowledge on cyber-security, so they can take care of the first steps of the incident response, thereby greatly increasing the overall resilience of the system, and (2) Preventive measures, performing asset-threat mapping by leveraging deep-packet inspection of industrial networks.

PREEMPTIVE

Sat, 01 Mar 2014 00:00:00 +0000

In recent years, we have witnessed an increase in the number and impact of cyber attacks. A successful attack might affect, or even endanger, daily human activities. Multiple countermeasures have been put in place to prevent Advanced Persistent Threat (APT) attacks, but they failed, allowing the latest generation of APT. The goal of PREEMPTIVE is to provide an innovative solution for enhancing existing methods and conceiving tools to prevent against cyber attacks, that target utility networks.

PREEMPTIVE addresses the prevention of cyber attacks against hardware and software systems such as DCS, SCADA, PLC, networked electronic sensing, and monitoring and diagnostic systems used by the utilities networks. Moreover, the research aims to implement detection tools based on a dual approach comprising low direct detection and process misbehavior detection PREEMPTIVE proposes to:

Enhance existing methodological security and prevention frameworks with the aim of harmonizing Risk and Vulnerability Assessment methods, standard policies, procedures and applicable regulations or recommendations to prevent cyber attacks.
Design and develop prevention and detection tools complaint to the dual approach that takes into account both the industrial process misbehavior analysis (physical domain) and the communication & software anomalies (cyber domain):
- Industrial process misbehavior detection tools.
- Communication & software related threats prevention and detection tools.
Define a taxonomy for classifying the utilities networks taking into account:
- The utility network type and communication technology used
- The utility network exposure to Cyber threats
- The impact to the citizens of services disruption caused by a cyber attack through the utility network.
Define guidelines for improving Critical Infrastructure (CI) surveillance.
Validate the PREEMPTIVE framework and innovative technologies in real scenarios with the support of the utility companies

CRISALIS

Tue, 01 May 2012 00:00:00 +0000

The CRISALIS project aims at providing new means to secure critical infrastructure environments from targeted attacks, carried out by resourceful and motivated individuals. The recent discovery of a malware called Stuxnet, show that these threats are already a reality. Their success in infiltrating Critical Infrastructure environments is calling attention on the ineffectiveness of standard security mechanisms at detecting them. Stuxnet is believed to have been operating undetected for almost one year leveraging multiple vulnerabilities that were previously unknown, and has been discovered only as a consequence to an operational anomaly that triggered the attention of the field operators. This fact clearly shows that our methods to find vulnerabilities and detect ongoing or successful attacks in critical infrastructure environments are not sufficient.

CRISALIS focuses on these two aspects: detection of vulnerabilities and attacks in critical infrastructure environments. We focus on two different, yet interlinked, use cases that are typical for the power grid infrastructure: control systems based on SCADA protocols and the Advanced Metering Infrastructure. CRISALIS leverages the unique characteristics of critical infrastructure environments to produce novel practical mechanisms and techniques for their security assessment and protection. This is achieved by pursuing three main research objectives:

providing new methodologies and techniques to secure critical infrastructure systems;
providing new tools to detect intrusions;
developing new, more effective, techniques to analyze infected systems.

Particular attention is paid to ensure the practical implementation of these techniques in real-world environments, and to minimize the impact on operations, goals which are attainable thanks to the direct involvement in the process of end users and device manufacturers who provide expertise and realistic test environments to validate the proposed methodologies.