Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting

  1. Iturbe, Mikel 1
  2. Garitano, Iñaki 1
  3. Zurutuza, Urko 1
  4. Uribeetxeberria, Roberto 1
  1. 1 Universidad de Mondragón/Mondragon Unibertsitatea
    info

    Universidad de Mondragón/Mondragon Unibertsitatea

    Mondragón, España

    ROR https://ror.org/00wvqgd19

Aktak:
Proceedings of the 11th Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications (VISIGRAPP 2016)

Argitaletxea: SCITEPRESS

ISBN: 9789897581755

Argitalpen urtea: 2016

Mota: Biltzar ekarpena

DOI: 10.5220/0005670000990106 GOOGLE SCHOLAR lock_openSarbide irekia editor

Laburpena

Industrial Control Systems are the set of specialized elements that monitor and control physical processes. Those systems are normally interconnected forming environments known as industrial networks. The particularities of these networks disallow the usage of traditional IT security mechanisms, while allowing other security strategies not suitable for IT networks. As industrial network traffic flows follow constant and repetitive patterns, whitelisting has been proved a viable approach for anomaly detection in industrial networks. In this paper, we present a network flow and related alert visualization system based on chord diagrams. The system represents the detected network flows within a time interval, highlighting the ones that do not comply the whitelisting rules. Moreover, it also depicts the network flows that, even if they are registered in the whitelist, have not been detected on the selected time interval (e.g. a host is down). Finally, the visualization system is tested w ith network data coming from a real industrial network.