Analysis of Security Events in Industrial Networks Using Self-Organizing Maps by the Example of Log4j

Ricardo Hormann, Daniel Bokelmann, Frank Ortmeier

2023

Abstract

Concepts such as Industry 4.0 are challenging the IT security of Industrial Control Networks (ICN) due to growing connectivity with insecure networks, such as corporate networks. Vulnerable devices within the ICN need to be protected by monitoring tools such as Intrusion Detection Systems (IDS). These tools not only provide information on suspicious traffic data observed, but also assess the semantics of an attack. Given the large number of security events generated by these systems, security analysts may overlook important annotations. This work attempts to leverage semantic annotations in combination with traffic and temporal information, using unsupervised machine learning methods (Self-Organizing Maps), to facilitate processing in the Security Operation Center. Instead of handling individual security events, our approach provides groups of heterogeneous security events leading to prototypical scenarios and classified and reusable use cases that only need to be analyzed once. We evaluate our approach using a non-synthetic dataset generated on a shop floor in the automotive sector, focusing on security events related to the Log4j vulnerability.

Paper Citation

in Harvard Style

Hormann R., Bokelmann D. and Ortmeier F. (2023). Analysis of Security Events in Industrial Networks Using Self-Organizing Maps by the Example of Log4j. In Proceedings of the 8th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS, ISBN 978-989-758-643-9, SciTePress, pages 51-60. DOI: 10.5220/0011839900003482

in Bibtex Style

@conference{iotbds23,
author={Ricardo Hormann and Daniel Bokelmann and Frank Ortmeier},
title={Analysis of Security Events in Industrial Networks Using Self-Organizing Maps by the Example of Log4j},
booktitle={Proceedings of the 8th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS,},
year={2023},
pages={51-60},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011839900003482},
isbn={978-989-758-643-9},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 8th International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS,
TI - Analysis of Security Events in Industrial Networks Using Self-Organizing Maps by the Example of Log4j
SN - 978-989-758-643-9
AU - Hormann R.
AU - Bokelmann D.
AU - Ortmeier F.
PY - 2023
SP - 51
EP - 60
DO - 10.5220/0011839900003482
PB - SciTePress