Monitoramento voltado à cibersegurança em sistemas industriais

Abstract

Industrial systems are very important in industries and critical infrastructure. Failures and cyber attacks on such systems can cause economic and environmental problems. With the popularization of the Internet and the benefits offered by interconnected systems, industrial systems that were previously isolated, now participate in the Internet, but having to deal with possible cyber attacks. Thus, the objective of this work was to develop a cyber security event monitoring architecture for industrial systems. The monitoring architecture developed stands out for being modular, scalable, distributed and for facilitating the coupling of different devices and technologies from the industrial and corporate sectors. The monitoring architecture collects data from monitored objects such as log files, network traffic, intrusion attempts, and stores them in a way that allows the construction of graphical visualizations and data correlation. In order to evaluate the proposed architecture, a prototype of the monitoring architecture was used to carry out experiments, which provided the validation of the use of architecture in the monitoring and construction of graphical visualizations. During the architecture assessment, it was found that the generated visualizations present relevant data from the monitored objects and can be useful for cybersecurity professionals to visually identify anomalies and cyber attacks. Thus, it was found that the proposed monitoring architecture can contribute to cybersecurity in industrial systems, and thus, mitigate damage caused by cyber attacks and anomalies.