Atıf Sayısı
4
Görüntüleme
32
İndirme
3
Artan teknoloji kullanımı ve sistemler arası entegrasyonun getirdiği kullanım kolaylığına ek olarak oluşan güvenlik açıkları günümüzde siber güvenliğin önemini artırmaktadır. Hükümetler, askeri, kurumsal, finans veya tıbbi kuruluşlar güvenlik tehdidi altında bulunmaktadır. Yaygınlaşan teknolojiyle beraber güvenli olmayan bilgisayar sistemleri, yıkıcı kesintilere, hassas bilgilerin ifşasına ve sahtekârlıklara yol açabilir. Endüstriyel varlıkların izlendiği ve kontrol edildiği sistemler Operasyonel Teknoloji (OT) olarak adlandırılır. Denetleyici Kontrol (PLC) ve Veri Toplama (SCADA) sistemleri OT sistem örneklerindendir. Bu sistemlere yapılan saldırılar, hayati önem taşıyan temel hizmetlerin sunulmasını engelleyebilir, ciddi ekonomik veya sosyal sonuçlara yol açabilir. Yapılarına güvenlik mekanizmalarının uygulanamayışı veya sahip oldukları eski bilişim teknolojilerinin yenilememesi sebepleri ile OT sistemler siber saldırılara karşı en savunmasız sistemlerdir. Bu çalışma kapsamında OT sistemleri için saldırı tespit ve uyarı sistemi geliştirilmiştir. OT sistemlerin mevcut durumu göz önüne alınarak tasarlanan sistem veri erişimini OPC sunucu üzerinden yapmakta ve bu sayede tüm OT sistemlerine minimum değişiklik ile bağlantı sağlayabilecek yapıdadır. OT sistemde meydana gelen işlemlerin algılanması ve analiz edilebilmesi için birliktelik analizi tabanlı aktivite kayıt oluşturma algoritması geliştirilmiş. Geliştirilen bu algoritma ile OT süreç bilgisi olmadan tüm aktivitelerin yorumlanabilmesine olanak sağlanmıştır. Oluşan aktivite bilgilerinin analizi için Bayes ağ tabanlı bir öğrenme sistemi tasarlanmıştır. Bu sistem sayesinde elde edilen kayıtlardan Bayes ağları oluşturulmakta ve sistem çalışma anında oluşan tüm aktiviteler değerlendirilerek olasılıklarına göre “Güvenli”, “Riskli” ve “Siber Saldırı” olarak gruplandırılmakta ve OT yetkililerine sunulmaktadır. Önerilen sistem her tür OT aktivitesine adapte olabilecek yapıdadır. Sistem mimari yapısı gereği sadece siber saldırı kategorisindeki işlemleri tespit etmekte kalmayıp sistemde yetkili kişilerin hatalı yâda kasıtlı müdahale veya program değişimlerini de algılayabilmektedir. Deneysel çalışmalarımız OT sisteme yapılan her türlü saldırının tespit edilebildiğini göstermektedir. Bu çalışma OT davranışlarının modellenerek öğrenildiği ve anormal davranışların tespit edilerek siber saldırıların tespit edildiği ilk çalışmadır.
In addition to the increased use of technology and the ease of use brought by inter-systems integration, security disadvantages are increasing the importance of cyber security today. Governments, military, corporate, financial or medical organizations are under security threat. With the wider technology, unsafe computer systems can lead to devastating interruptions, disclosure of sensitive information and fraud. The systems where industrial assets are monitored and controlled are called Operational Technology (OT). Control Control (PLC) and Data Collection (SCADA) systems are among the OT systems examples. Attacks on these systems may prevent the provision of vital basic services and lead to serious economic or social consequences. Due to the failure to apply security mechanisms to their structures or the failure to renew the old IT technologies they have, OT systems are the most undefenseful systems against cyber attacks. In the framework of this study, an attack detection and warning system for OT systems has been developed. The system, designed to take into account the current state of the OT systems, makes data access through the OPC server and is in the structure that can provide connection to all the OT systems with a minimum change. The activity recording algorithm based on co-analysis has been developed to detect and analyze the processes that occur in the OT system. This algorithm has been developed to allow all activities to be interpreted without the knowledge of the OT process. A Bayes network-based learning system has been designed to analyze the information of the activity that is created. From the records obtained through this system, Bayes networks are created and all the activities that occur at the moment of the system’s operation are assessed and grouped as “Safe”, “Riskful” and “Cyber Attack” according to their probability and are presented to the OT authorities. The recommended system is in a structure that can adapt to any type of OT activity. Due to the architectural structure of the system, it is not only able to detect the operations in the category of cyber attacks, but it is also able to detect the erroneous or intentional interventions or program changes by authorized persons in the system. Our experimental studies show that any type of attack on the OT system can be detected. This study is the first study in which OT behaviors are learned by modeling and an abnormal behavior is detected by cyber attacks.
In addition to the ease of use brought by the increasing use of technology and integration between systems, the resulting security vulnerabilities increase the importance of cybersecurity today. Governments, military, corporate, financial, or medical organizations are under security threats. With the spread of technology, unsafe computing systems can lead to devastating interruptions, sensitive information disclosure, and fraud. Systems in which industrial assets are monitored and controlled are called Operational Technology (OT). Supervisory Control (PLC) and Data Acquisition (SCADA) systems are examples of OT systems. Attacks on these systems can hinder the delivery of vital essential services and have serious economic or social consequences. OT systems are the most vulnerable systems against cyber-attacks since security mechanisms cannot be applied to their structures or the old information technologies they have are not renewed. Within the scope of this study, an intrusion detection and warning system has been developed for OT systems. The system, which is designed considering the current situation of OT systems, makes data access through the OPC server and thus, it is in a structure that can provide a connection to all OT systems with minimum changes. To detect and analyze the transactions occurring in the OT system, an association analysis based activity record creation algorithm has been developed. With this developed algorithm, it is possible to interpret all activities without OT process knowledge. A Bayes network-based learning system was designed to analyze the activity information. Bayes networks are created from the records obtained through this system and all activities that occur during the system operation are evaluated, grouped as "Safe", "Risky" and "Cyber Attack" according to their probabilities and presented to OT officials. The proposed system is capable of adapting to all types of OT activities. Due to the architecture of the system, it not only detects transactions in the cyberattack category but also detects faulty or deliberate intervention or program changes by authorized persons in the system. Our experimental studies show that any attack on the OT system can be detected. This study is the first study in which OT behaviors are modeled and learned, and cyberattacks are detected by detecting abnormal behaviors.
Alan : Fen Bilimleri ve Matematik; Mühendislik
Dergi Türü : Uluslararası
Makale Detay 
Atıf Yapanlar
Benzer Makaleler
PDF Görüntüle
Dergi Bilgisi
Eseri Dinleyin
Bu Sayfayı Yazdırın
Paylaş
Mendeley
