Integration of agents and components on a distributed security architecture
Ferreira, João António Rodrigues
MSc Thesis · 2019 · University of Coimbra
Supervisors: Nuno Miguel Mendonça da Silva Gonçalves, Tiago José dos Santos Martins da Cruz
Abstract
Over the past recent years there has been a massive industry growth, and something we call the Internet of Things has emerged. This phenomenon has set the path for a paradigm shift in the Industrial Sector, which has allowed for a wider range of digital interconnectivity when it comes to various industry components.This however has also opened a way for different types of malicious activity agaisnt the industry. Since the systems went from being air gapped to being remotely connected to a vast range of networks and other third-party systems, various exploits have been made possible in order to maliciously affect those industry components. ATENA, an European Project, aims to provide a range of modern tools to detect and prevent such activity.This thesis' work is part of the lowest level in the ATENA architecture, the detection of anomalies and events taking place at any point in a host or network, done by multiple probes. These events should then be taken to a platform where the administrator can monitor and analyze them. In order to transfer such data between multiple components, a format (IADS Data Model) is followed throughout the entirety of the IDS platform, the IADS. In order to read, encode and send to the other components all events from all existing, and yet under development, probes, a wrapper or adapter had to be created, giving the administrator the tools required in order to configure how the probe's output is translated into an IADS Data Model format event. This wrapper, as well as the mechanisms of differentiating probe outputs, encoding and validating them, and sending the encoded events to the rest of the IADS Platform, is part of this thesis' work.