Esrel08 Final

F. Flammini, A. Gaglione, N. Mazzocca, C. Pragliola DETECT: a novel framework for the detection of attacks to critical infrastructures presented by Andrea Gaglione Dipartimento di Informatica e Sistemistica Università di Napoli “Federico II” Via Claudio 21, 80125 Napoli Email: [email_address] Web: http://wpage.unina.it/andrea.gaglione European Safety & Reliability Conference, ESREL’08 22-25 September 2008 , Valencia, Spain

Outline ,[object Object],[object Object],[object Object],[object Object]

Critical Infrastructure Protection Transportation Banking Energy and utilities Government Health

CIP event cycle ,[object Object],[object Object],[object Object],[object Object],Analysis and assessment Remediation Indications and warning Mitigation Response Reconstitution Pre-Event Post-Event ,[object Object],[object Object],Event

The DETECT approach ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],DETECT Engine Alarm level (1, 2, 3, ...) Detected attack scenario Event History Scenario Repository

The Event Description Language (EDL) ,[object Object],Primitive Event: condition on a specific sensor Composite Event: combination of primitive events defined by means of proper operators Chakravarthy, S. & Mishra, D. 1994. Snoop: An expressive event specification language for active databases. Data Knowl. Eng. , Vol. 14, No. 1, pp. 1–26. ,[object Object],[object Object],[object Object],[object Object],[object Object]

Event Trees ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Leaf: primitive event internal node: EDL operator  formal expression  t1< t | ( E1(t)  E2(t1)  E1(t1)  E2(t) ) [T]  |t – t1| ≤ T

The software architecture of DETECT ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Current implementation

Parameter contexts ,[object Object],[object Object],[object Object],[object Object],[object Object]

An example scenario ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Tunnel portal protection

An example scenario ,[object Object],(E1 AND E2) OR E3 SEQ (E4 AND E5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Conclusions and future works ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

THE END Thank you for your kind attention … any questions?

Esrel08 Final

Recommended

Recommended

More Related Content

Similar to Esrel08 Final

Similar to Esrel08 Final (20)

More from Francesco Flammini

More from Francesco Flammini (20)

Recently uploaded

Recently uploaded (20)

Esrel08 Final