A Network Telescope for Early Warning Intrusion Detection

Chatziadam, Panos; Askoxylakis, Ioannis G.; Fragkiadakis, Alexandros

doi:10.1007/978-3-319-07620-1_2

Cited by 10 publications

(8 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Simple honeypots and SCADA‐specific honeypots are deployed to emulate the exact network and SCADA system setup present in the SDN‐enabled wind park. Moreover, passive honeypots (early warning intrusion detection systems (EWIS) in specific) are also part of the Honeynet, acting as a network telescope on the production part of the industrial network to monitor all activity in normally unused parts of the network. Such activity is a good indicator of malicious entities operating on the network (such as an attacker probing/foot‐printing the network), thus providing early warning of incoming attacks.…”

Section: Reactive Security Framework Implementationmentioning

confidence: 99%

Reactive security for SDN/NFV‐enabled industrial networks leveraging service function chaining

Petroulakis

Fysarakis

Askoxylakis

et al. 2017

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The innovative application of fifth‐generation core technologies, ie, software‐defined networking (SDN) and network function virtualization, can help reduce capital and operational expenditures in industrial networks. Nevertheless, SDN expands the attack surface of the communication infrastructure, thus necessitating the introduction of additional security mechanisms. These major changes could not leave the industrial environment unaffected, with smart industrial deployments gradually becoming a reality, a trend that is often referred to as the Fourth Industrial Revolution or Industry 4.0. A wind park is a good example of an industrial application relying on a network with strict performance, security, and reliability requirements and was chosen as a representative example of industrial systems. This work highlights the benefit of leveraging the flexibility of SDN/network function virtualization–enabled networks to deploy enhanced reactive security mechanisms for the protection of the industrial network via the use of service function chaining. Moreover, the implementation of a proof‐of‐concept reactive security framework for an industrial‐grade wind park network is presented, along with a performance evaluation of the proposed approach. The framework is equipped with SDN and supervisory control and data acquisition honeypots, modeled on and deployable to the wind park, allowing continuous monitoring of the industrial network and detailed analysis of potential attacks, thus isolating attackers and enabling the assessment of their level of sophistication. Moreover, the applicability of the proposed solutions is assessed in the context of the specific industrial application based on the analysis of the network characteristics and requirements of an actual operating wind park.

show abstract

Section: Reactive Security Framework Implementationmentioning

confidence: 99%

Reactive security for SDN/NFV‐enabled industrial networks leveraging service function chaining

Petroulakis

Fysarakis

Askoxylakis

et al. 2017

Trans Emerging Tel Tech

View full text Add to dashboard Cite

show abstract

“…Such an infrastructure is mainly characterized by the size of the subnetwork defined by the prefix length. Although such an approach seems rather limited than more active techniques like honeypots emulating real services, they have been shown to be complementary [8], [9].…”

Section: Background and Related Workmentioning

confidence: 99%

Topological analysis and visualisation of network monitoring data: Darknet case study

Marc

Lahmadi

Jérôme

2016

2016 IEEE International Workshop on Information Forensics and Security (WIFS)

View full text Add to dashboard Cite

Network monitoring is a primordial source of data in cyber-security since it may reveal abnormal behaviors of users or applications. Indeed, security analysts and tools like IDS (Intrusion Detection system) or SIEM (security information and event management) rely on them as a single source of information or combined with others. In this paper, we propose a visualisation method derived from the Mapper algorithm that has been developed in the field of Topological Data Analysis (TDA). The developed method and its associated tool are able to analyze a large number of IP packets in order to make malicious activities patterns easily observable by security analysts. We applied our method to darknet data, i.e. from an entire and supposed not used subnetwork in Internet and we have found that those observable patterns have been missed by Suricata, a widely used State-ofthe-Art IDS.

show abstract

“…The system's architecture includes a network of distributed low-interaction sensors and a central server [1]. The sensors are small computing platforms [2] that by design are easy to deploy in a distributed fashion to a large number of partner organizations.…”

Section: Introductionmentioning

confidence: 99%