SMS-I: Intelligent Security for Cyber–Physical Systems
Critical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remedia...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-08-01
|
| Series: | Information |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2078-2489/13/9/403 |
| _version_ | 1827660232846737408 |
|---|---|
| author | Eva Maia Norberto Sousa Nuno Oliveira Sinan Wannous Orlando Sousa Isabel Praça |
| author_facet | Eva Maia Norberto Sousa Nuno Oliveira Sinan Wannous Orlando Sousa Isabel Praça |
| author_sort | Eva Maia |
| collection | DOAJ |
| description | Critical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remediation of security attacks more difficult. Therefore, improving cyber–physical correlations, forensics investigations, and Incident response tasks is of paramount importance. This work describes the SMS-I tool that allows the improvement of these security aspects in critical infrastructures. Data from heterogeneous systems, over different time frames, are received and correlated. Both physical and logical security are unified and additional security details are analysed to find attack evidence. Different Artificial Intelligence (AI) methodologies are used to process and analyse the multi-dimensional data exploring the temporal correlation between cyber and physical Alerts and going beyond traditional techniques to detect unusual Events, and then find evidence of attacks. SMS-I’s Intelligent Dashboard supports decision makers in a deep analysis of how the breaches and the assets were explored and compromised. It assists and facilitates the security analysts using graphical dashboards and Alert classification suggestions. Therefore, they can more easily identify anomalous situations that can be related to possible Incident occurrences. Users can also explore information, with different levels of detail, including logical information and technical specifications. SMS-I also integrates with a scalable and open Security Incident Response Platform (TheHive) that enables the sharing of information about security Incidents and helps different organizations better understand threats and proactively defend their systems and networks. |
| first_indexed | 2024-03-09T23:41:08Z |
| format | Article |
| id | doaj.art-a3ad3acdbfdd44769a535fcdedcb233a |
| institution | Directory Open Access Journal |
| issn | 2078-2489 |
| language | English |
| last_indexed | 2024-03-09T23:41:08Z |
| publishDate | 2022-08-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Information |
| spelling | doaj.art-a3ad3acdbfdd44769a535fcdedcb233a2023-11-23T16:52:59ZengMDPI AGInformation2078-24892022-08-0113940310.3390/info13090403SMS-I: Intelligent Security for Cyber–Physical SystemsEva Maia0Norberto Sousa1Nuno Oliveira2Sinan Wannous3Orlando Sousa4Isabel Praça5GECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalGECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalGECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalGECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalGECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalGECAD—Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development, School of Engineering of the Polytechnic of Porto (ISEP), 4249-015 Porto, PortugalCritical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remediation of security attacks more difficult. Therefore, improving cyber–physical correlations, forensics investigations, and Incident response tasks is of paramount importance. This work describes the SMS-I tool that allows the improvement of these security aspects in critical infrastructures. Data from heterogeneous systems, over different time frames, are received and correlated. Both physical and logical security are unified and additional security details are analysed to find attack evidence. Different Artificial Intelligence (AI) methodologies are used to process and analyse the multi-dimensional data exploring the temporal correlation between cyber and physical Alerts and going beyond traditional techniques to detect unusual Events, and then find evidence of attacks. SMS-I’s Intelligent Dashboard supports decision makers in a deep analysis of how the breaches and the assets were explored and compromised. It assists and facilitates the security analysts using graphical dashboards and Alert classification suggestions. Therefore, they can more easily identify anomalous situations that can be related to possible Incident occurrences. Users can also explore information, with different levels of detail, including logical information and technical specifications. SMS-I also integrates with a scalable and open Security Incident Response Platform (TheHive) that enables the sharing of information about security Incidents and helps different organizations better understand threats and proactively defend their systems and networks.https://www.mdpi.com/2078-2489/13/9/403cyber–physical systemsdigital forensicscyber–physical systems forensicsmachine learningrule miningsecurity incident response |
| spellingShingle | Eva Maia Norberto Sousa Nuno Oliveira Sinan Wannous Orlando Sousa Isabel Praça SMS-I: Intelligent Security for Cyber–Physical Systems Information cyber–physical systems digital forensics cyber–physical systems forensics machine learning rule mining security incident response |
| title | SMS-I: Intelligent Security for Cyber–Physical Systems |
| title_full | SMS-I: Intelligent Security for Cyber–Physical Systems |
| title_fullStr | SMS-I: Intelligent Security for Cyber–Physical Systems |
| title_full_unstemmed | SMS-I: Intelligent Security for Cyber–Physical Systems |
| title_short | SMS-I: Intelligent Security for Cyber–Physical Systems |
| title_sort | sms i intelligent security for cyber physical systems |
| topic | cyber–physical systems digital forensics cyber–physical systems forensics machine learning rule mining security incident response |
| url | https://www.mdpi.com/2078-2489/13/9/403 |
| work_keys_str_mv | AT evamaia smsiintelligentsecurityforcyberphysicalsystems AT norbertosousa smsiintelligentsecurityforcyberphysicalsystems AT nunooliveira smsiintelligentsecurityforcyberphysicalsystems AT sinanwannous smsiintelligentsecurityforcyberphysicalsystems AT orlandosousa smsiintelligentsecurityforcyberphysicalsystems AT isabelpraca smsiintelligentsecurityforcyberphysicalsystems |