Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Automated Incident Response for Industrial Control Systems Leveraging Software-defined Networking

: Patzer, Florian; Meshram, A.; Heß, M.

Postprint urn:nbn:de:0011-n-5436573 (368 KByte PDF)
MD5 Fingerprint: 4c5c48fc25e5080789630f25eda46096
Erstellt am: 14.5.2019

Mori, Paolo (Ed.) ; Institute for Systems and Technologies of Information, Control and Communication -INSTICC-, Setubal:
ICISSP 2019, 5th International Conference on Information Systems Security and Privacy : Prague, Czech Republic, February 23 - 25, 2019; Proceedings
Setubal: SciTePress, 2019
ISBN: 978-989-758-359-9
International Conference on Information Systems Security and Privacy (ICISSP) <5, 2019, Prague>
Konferenzbeitrag, Elektronische Publikation
Fraunhofer IOSB ()
incident response; SDN security; industrial control system; ICS Security; software-defined networking

Modern technologies and concepts for Industrial Control Systems (ICS) are evolving towards high flexibility of processes and respectively networks. Such dynamic networks are already functioning well, for example in data centres. This is enabled by application of the Software-defined Networking (SDN) paradigm. For this reason, ICS is currently adopting SDN. The concept of having a centralized view of the network and generating packet forwarding rules to control it enables performing automated responses to network events and classified incidents via SDN. This automation can provide timely and, due to the holistic view of the network, accurate incident response actions. However, availability, safety, real-time and redundancy requirements within the ICS domain restrict the application of such an automated approach. At present, SDN-based incident response (SDN-IR) does not take into consideration these requirements. In this work, we identify possible SND-based response actions to ICS incidents and introduce classification of assets and links. Furthermore, we present a concept for SDN-IR where a predefined rule set restricts the response actions based on the asset’s classification thereby satisfying ICS specific requirements. Subsequently, we describe and evaluate a prototype implementation of this concept, built with the open-source SDN platform OpenDaylight and the SDN protocol OpenFlow.