A Tool to Support the Investigation and Visualization of Cyber and/or Physical Incidents

Macedo, Inês; Wanous, Sinan; Oliveira, Nuno; Sousa, Orlando; Praça, Isabel

doi:10.1007/978-3-030-72654-6_13

Cited by 2 publications

(2 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, this work presents a more complete version of the SMS-I tool. A first draft was presented at [22], and a more complete version of this draft was presented at [23]. This work shows in more detail the capabilities presented in the previous works, but also introduces a new capability: the Incident response.…”

Section: Introductionmentioning

confidence: 82%

SMS-I: Intelligent Security for Cyber–Physical Systems

et al. 2022

View full text Add to dashboard Cite

Critical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remediation of security attacks more difficult. Therefore, improving cyber–physical correlations, forensics investigations, and Incident response tasks is of paramount importance. This work describes the SMS-I tool that allows the improvement of these security aspects in critical infrastructures. Data from heterogeneous systems, over different time frames, are received and correlated. Both physical and logical security are unified and additional security details are analysed to find attack evidence. Different Artificial Intelligence (AI) methodologies are used to process and analyse the multi-dimensional data exploring the temporal correlation between cyber and physical Alerts and going beyond traditional techniques to detect unusual Events, and then find evidence of attacks. SMS-I’s Intelligent Dashboard supports decision makers in a deep analysis of how the breaches and the assets were explored and compromised. It assists and facilitates the security analysts using graphical dashboards and Alert classification suggestions. Therefore, they can more easily identify anomalous situations that can be related to possible Incident occurrences. Users can also explore information, with different levels of detail, including logical information and technical specifications. SMS-I also integrates with a scalable and open Security Incident Response Platform (TheHive) that enables the sharing of information about security Incidents and helps different organizations better understand threats and proactively defend their systems and networks.

show abstract

Section: Introductionmentioning

confidence: 82%

SMS-I: Intelligent Security for Cyber–Physical Systems

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Macedo et al [80] presented a tool that aims to combine an intuitive user interface with machine learning forecasts that display the available data through time-series visualizations. The dynamic user interface of this tool is intended to display pertinent information in supporting the investigation of cyber and physical attacks that are presented in a user-friendly manner.…”

Section: ) the Root-cause Visualizationmentioning

confidence: 99%

A Review of Visualization Methods for Cyber-Physical Security: Smart Grid Case Study

Cobilean,

Mavikumbure,

Mcbride

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Cyber-Physical Systems (CPSs) are becoming increasingly complex and interconnected as they attempt to meet the demands of evolving society. As a result, monitoring and maintaining them becomes a more complex and demanding task for control system operators and cyber defenders. While the literature on visualization techniques in the context of cybersecurity is extensive, the same cannot be said for studies on visualization for the security of cyber-physical systems. This paper aims to fill that gap by: 1) defining the main features of a visualizations workflow for security visualizations in cyber-physical systems. The workflow includes the acquisition of cyber and physical data, processing of data, selection, and configuration of both visualization tools and end-user interactions. 2) Providing an overview of cyber-physical security visualization systems, with a focus on smart grids as a case study. Finally, we use the perspectives gained from this analysis to provide insights and directions for future research and design of cyber-physical visualization techniques.

show abstract

A Tool to Support the Investigation and Visualization of Cyber and/or Physical Incidents

Cited by 2 publications

References 15 publications

SMS-I: Intelligent Security for Cyber–Physical Systems

SMS-I: Intelligent Security for Cyber–Physical Systems

A Review of Visualization Methods for Cyber-Physical Security: Smart Grid Case Study

Contact Info

Product

Resources

About