Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting

Mikel Iturbe, Iñaki Garitano, Urko Zurutuza, Roberto Uribeetxeberria

2016

Abstract

Industrial Control Systems are the set of specialized elements that monitor and control physical processes. Those systems are normally interconnected forming environments known as industrial networks. The particularities of these networks disallow the usage of traditional IT security mechanisms, while allowing other security strategies not suitable for IT networks. As industrial network traffic flows follow constant and repetitive patterns, whitelisting has been proved a viable approach for anomaly detection in industrial networks. In this paper, we present a network flow and related alert visualization system based on chord diagrams. The system represents the detected network flows within a time interval, highlighting the ones that do not comply the whitelisting rules. Moreover, it also depicts the network flows that, even if they are registered in the whitelist, have not been detected on the selected time interval (e.g. a host is down). Finally, the visualization system is tested with network data coming from a real industrial network.

Paper Citation

in Harvard Style

Iturbe M., Garitano I., Zurutuza U. and Uribeetxeberria R. (2016). Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting . In Proceedings of the 11th Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications - Volume 2: IVAPP, (VISIGRAPP 2016) ISBN 978-989-758-175-5, pages 99-106. DOI: 10.5220/0005670000990106

in Bibtex Style

@conference{ivapp16,
author={Mikel Iturbe and Iñaki Garitano and Urko Zurutuza and Roberto Uribeetxeberria},
title={Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting},
booktitle={Proceedings of the 11th Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications - Volume 2: IVAPP, (VISIGRAPP 2016)},
year={2016},
pages={99-106},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005670000990106},
isbn={978-989-758-175-5},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 11th Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications - Volume 2: IVAPP, (VISIGRAPP 2016)
TI - Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting
SN - 978-989-758-175-5
AU - Iturbe M.
AU - Garitano I.
AU - Zurutuza U.
AU - Uribeetxeberria R.
PY - 2016
SP - 99
EP - 106
DO - 10.5220/0005670000990106