Reference : Risk Monitoring and Intrusion Detection for Industrial Control Systems
Dissertations and theses : Doctoral thesis
Engineering, computing & technology : Computer science
Security, Reliability and Trust
Risk Monitoring and Intrusion Detection for Industrial Control Systems
Muller, Steve mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
University of Luxembourg, ​​Luxembourg
Docteur de l’Université du Luxembourg en Informatique
xvi, 134 + 24
Le Traon, Yves mailto
Bonnin, Jean-Marie mailto
Klein, Jacques mailto
Ludinard, Romaric mailto
Viet Triem Tong, Valérie mailto
Flaus, Jean-Marie mailto
[en] real-time risk management ; risk monitoring ; dependency modelling ; industrial control systems ; intrusion detection
[en] Cyber-attacks on critical infrastructure such as electricity, gas, and water distribution, or power plants, are more and more considered to be a relevant and realistic threat to the European society.
Whereas mature solutions like anti-malware applications, intrusion detection systems (IDS) and even intrusion prevention or self-healing systems have been designed for classic computer systems, these techniques have only been partially adapted to the world of Industrial Control Systems (ICS).
As a consequence, organisations and nations fall back upon risk management to understand the risks that they are facing.
Today's trend is to combine risk management with real-time monitoring to enable prompt reactions in case of attacks.
This thesis aims at providing techniques that assist security managers in migrating from a static risk analysis to a real-time and dynamic risk monitoring platform.

Risk monitoring encompasses three steps, each being addressed in detail in this thesis: the collection of risk-related information, the reporting of security events, and finally the inclusion of this real-time information into a risk analysis.
The first step consists in designing agents that detect incidents in the system.
In this thesis, an intrusion detection system is developed to this end, which focuses on an advanced persistent threat (APT) that particularly targets critical infrastructures.
The second step copes with the translation of the obtained technical information in more abstract notions of risk, which can then be used in the context of a risk analysis.
In the final step, the information collected from the various sources is correlated so as to obtain the risk faced by the entire system.
Since industrial environments are characterised by many interdependencies, a dependency model is elaborated which takes dependencies into account when the risk is estimated.
Fonds National de la Recherche - FnR
Researchers ; Professionals
FnR ; FNR10239425 > Steve Muller > Risk Monitoring with Intrusion Detection for Industrial control systems

File(s) associated to this reference

Fulltext file(s):

Open access
Risk Monitoring and Intrusion Detection for Industrial Control Systems.pdfAuthor postprint3.27 MBView/Open

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.