Virtual incident response functions in control systems
Virtual incident response functions in control systems
复制标题
控制系统中的虚拟事件响应功能
DOI：
10.1016/j.comnet.2018.01.040
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
S. Rueda
中科院分区：
文献类型：
--
作者：
Andrés Felipe Murillo;Vikram Gaur;J. Giraldo;A. Cárdenas;S. Rueda
在过去的十年中，工业控制系统的安全性已经成为研究的重点，以保护我们的关键基础设施。大量的研究工作集中在工业网络中的入侵检测，然而，很少有人讨论入侵被检测到后该怎么办。由于大多数控制系统的安全性是时间敏感的，我们需要对自动事件响应进行新的研究。在本文中，我们将展示软件定义网络和网络功能虚拟化如何促进针对工业网络的各种攻击的自动事件响应。我们还原型的事件响应解决方案，检测和自动响应传感器攻击和控制器攻击。我们的工作表明，支持云的软件定义网络和虚拟基础设施可以为工业系统提供新型深度防御解决方案。
In the past decade the security of industrial control systems has emerged as a research priority in order to safeguard our critical infrastructures. A large number of research efforts have focused on intrusion detection in industrial networks, however, few of them discuss what to do after an intrusion has been detected. Because the safety of most of these control systems is time-sensitive, we need new research onautomaticincident response. In this article we show how software-defined networks, and network-function virtualization can facilitate automatic incident response to a variety of attacks against industrial networks. We also prototype an incident response solution that detects and responds automatically to sensor attacks and controller attacks. Our work shows the promise that cloud-enabled software-defined networks and virtual infrastructures hold as a way to provide novel defense-in-depth solutions for industrial systems.