Os Sistemas de Controlo Industriais (ICS) estão a começar a fundir-se com as soluções de IT, por forma a promover a interconectividade. Embora isto traga inúmeros benefícios de uma perspetiva de controlo, os ICS apresentam uma falta de mecanismos de segurança que consigam evitar possíveis ameaças informáticas, quando comparados aos comuns sistemas de informação [29], [64]. Dada a natureza crítica destes sistemas, e a ocorrências recentes de ciberataques desastrosos, a segurança ´e um tópico que deve ser incentivado. À luz deste problema, na presente dissertação apresentamos uma avaliação de possíveis aplicações e controlos de segurança a serem implantados nestes ambientes críticos e a implementação de uma solução de segurança extensível que dá resposta a certos ataques focados em sistemas industriais, capaz de ser implantada em qualquer rede industrial que permita a sua ligação. Com o auxilio de uma framework extensivel e portátil para testes de ICS, e outros ambientes industriais de testes, foi possível analisar diferentes cenários de ameaças, implantar mecanismos de segurança para os detetar e avaliar os resultados, com o intuito de fornecer uma ideia de como empregar estes mecanismos da melhor maneira possível num ambiente real de controlo industrial.

The Internet of Things (IoT) is a new model that integrates physical objects and Internet and became one of the principal technological evolutions of computing. It is estimated that a trillion of physical objects will be connected to the Internet until 2022. The low accessibility and the lack of interoperability of many of these devices in a vast heterogenous landscape will make it very hard to design specific security measures and apply specific security mechanism. Moreover, IoT networks still exposed and vulnerable to attacks aimed to disrupt the network. Therefore, additional security tools specific to IoT are needed. Intrusion Detection System (IDS) could fulfill this purpose. In this paper, we present a literature review on the IDS in IoT topic, mainly focusing on the current state of research by examining the literature, identifying current trends and presenting open issues and future directions.

Um sistema Internet of Things (IoT) tem um largo leque de aplicações e de ambientes de utilização, isto é, desde uma rede doméstica a uma rede industrial, ou desde uma rede com alguns dispositivos IoT a uma rede com milhares de dispositivos IoT. Os dispositivos que estão presentes nos sistemas IoT podem ter características diversas, por exemplo, diferentes versões de sistemas operativos instalados e diferentes capacidades e recursos disponíveis. Em suma, um sistema IoT pode apresentar um elevando nível de heterogeneidade. De forma a facilitar e a normalizar a operação dos sistemas IoT, existem vários tipos de standards e de protocolos que podem ser utilizados, tais como, o Message Queuing Telemetry Transport (MQTT), que não é específico para um sistema IoT mas que pela sua simplicidade é bastante utilizado, e a sua variante segura o Message Queuing Telemetry Transport over TLS (MQTTS). As utilizações do MQTT e do MQTTS facilitam a uniformização e a comunicação entre os vários dispositivos IoT. Estes sistemas IoT, são compostos por vários dispositivos IoT. Estes caracterizam-se por terem fracos recursos de hardware, nomeadamente ao nível da capacidade de memória Random-Access Memory (RAM) ou Read-Only Memory (ROM), de processamento e de armazenamento em disco. Estes dispositivos estão frequentemente expostos a ambientes exteriores e, por isso, estão mais vulneráveis a ataques à sua integridade e disponibilidade, bem como, à informação por si recolhida e transmitida. A monitorização do tráfego e a deteção das anomalias podem dar um forte contributo para a mitigação destas ameaças, podendo ser efetuadas através de soluções do tipo Intrusion Detection System (IDS). Estas soluções são caracterizadas por causar um baixo impacto no desempenho dos sistemas IoT e, por isso, representam uma solução interessante de integração neste tipo de sistemas. No entanto, é essencial que os sistemas de IDS tenham na sua base de dados interna as especificações, as regras e os comportamentos necessários para analisar o tráfego que flui num sistema IoT. É neste âmbito que se enquadra este trabalho, nomeadamente na análise, na caracterização e na avaliação das especificações do tráfego gerado pelos aplicativos MQTT e MQTTS, tendo-se determinado os Information Elements (IE) mais relevantes a considerado e criado um cenário de testes capaz de capturar esses IE. Posteriormente, esses IE foram analisados com o intuito de caracterizar de forma generalista o tráfego MQTT e o tráfego MQTTS.

As redes de computadores são o meio mais comum, e natural, de utilização para trabalho e comunicação pelas massas levando a um enorme volume de transações de dados. O volume de dados transmitidos tem aumentado bastante nos últimos anos, contendo dados sensíveis e informações confidenciais que têm sido sucessivamente utilizados para fins ilícitos. Com o objetivo de mitigar a invasão de privacidade dos dados alojados nos sistemas de informação das organizações, têm sido implementados nas redes várias soluções de segurança como os Intrusion Detection System (IDS)s. Estas soluções quando são implementadas necessitam de passar por um conjunto de testes por forma a garantir a sua robustez e capacidade de ação nas várias situações de intrusão. É nesta problemática que se foca este trabalho onde através da geração de datasets compostos por pacotes de rede de tráfego normal e anormal (ataques) em formato pcap se pretende testar a robustez das soluções implementadas. Sendo que se pretende colmatar a atualmente reduzida existência de datasets de teste que representem tráfego aproximado ao real. Esta construção tem por base dados reais, pré-capturados na rede em teste, para serem posteriormente estudados estatisticamente com o objetivo de encontrar um padrão de comportamento/utilização para adaptar os dados resultantes à realidade em causa. Esta abordagem foca-se principalmente na realidade dos dados capturados, permitindo assim produzir datasets com um grau de semelhança à realidade igualmente elevado. Além da abordagem técnica em formato pcap, este trabalho pretende também testar mecanismos mais específicos como IDSs produzidos no âmbito de trabalhos de investigação. Para isso é possível criar datasets em formato de texto simples, onde os campos que os compõe, bem como a sua ordem, são totalmente personalizáveis consoante as necessidades. Deste trabalho surgiu um protótipo de uma aplicação, disponível em http://www.sourceforge.net/p/rndgen, em perl, utilizável para efetuar a criação dos datasets pretendidos.

This work describes the realization of an IDS solution in a productive environment. It was intended to evaluate its feasibility comparing some options and thus opening the possibility of putting this solution in inline mode. Hence, the host organization may consider replacing a current security solution (proprietary hardware and software), with a Free Software or Open Source firewall and IPS. Typically the market presents products developed for this purpose using dedicated hardware, creating highly efficient and robust black boxes. For these products the manufacturers guarantee a series of commitments, taking advantage of high values for licensing, additional features or even product support. Sometimes these products are based on community projects being brought to market by vendors in proprietary variants. In this perspective, it was intended, in this work, to evaluate the possibility of creating a defense environment entirely based on alternatives to the manufacturers’, from the operating system to the application’s level evaluation layers. This work provides a series of laboratory simulations (using virtualization), the placement in staging of the IDS solution, the comparison of actual results with real traffic, and retrieving the physical evaluation of comparable resources. In this way an evaluation of this solution will be presented to the host organization so that an informed decision is made about its possible implementation in production, to replace a proprietary solution. We found that, in fact, it is possible to use commodity hardware to implement such solution in the tested environment, and with the presented traffic demand. At least one of the tested IDSs (Suricata) performed flawlessly, for several days, in a highly dense and complex network, where more than 3Gbps with peaks around 4.5Gbps were observed. The work also reports on scenarios where two concurrent instances were run, with each one inspecting a dedicated 10Gbps listening interface.

Nowadays, the Internet of Things (IoT) has a big impact on our way of living, making security a huge concern. In many cases, standard techniques like firewalls are unable to prevent intrusions, and thus, Intrusion Detection Systems (Intrusion Detection System (IDS)s) are required, either for detecting external or internal breaches of security. Currently, for the IoT, there are no ready-to-use IDS solutions based on pattern recognition. The main goal of this work is to develop an Anomaly-based IDS for the IoT, operating at the Constrained Application Protocol (CoAP). The new Anomaly-based IDS, AnIDS, is presented along with the architecture, software libraries, platforms, scenario and performance evaluation. Client CoAP level misbehaviors are programmed in Contiki, and features are calculated with Wireshark, a packet dissector. These features are pre-processed by standardization and the feature extraction algorithms Principal Component Analysis (PCA) and Linear Discriminant Analysis (LDA). The resulting data is processed using Support Vector Machine (SVM), a machine learning algorithm based on the Scikit-Learn package, in order to train a classifier. This classifier is evaluated with the plotting of Confusion Matrices and Receiving Operator Characteristic (ROC) Curves. AnIDS allows to detect the signs of an intrusion, by cross checking the normal behavior, known a priori of the nodes, with a known data pattern of intrusion. AnIDS is also able to identify the type of misbehavior present on a node based on a priori data patterns of the specific intrusion. The Client CoAP misbehavior implemented are: implicit Denial of Service (DoS), repeatedly Acknowledgement (ACK) sending, wrong URI requesting, and invalid CoAP content accept option requesting. Results demonstrate that AnIDS can obtain an F_Measure and a Recall scores of ∼ 98%, demonstrating that the system is capable to distinguish between the normal and the intruder behavior. As CoAP is the most disseminated open source application protocol on the IoT, AnIDS can have a significant impact on IoT security.

In a world increasingly connected with equipment permanently attached, the risk of cybersecurity had rise. Among the various vulnerabilities and forms of exploitation, the Botnets are those being addressed in this work. The number of botnets related infections has grown critically and, due to botnets’ increased capacity and potential use for future infections, a continued development of solutions is needed to strengthen the protection of networks and systems. Intrusion Detection Systems (IDS) are one of the solutions that try to follow this evolution. The continuous evolution of tools and attack forms in order to evade detection, using mechanisms such as encryption (IPSec, SSL) and diverse architecture and different ways of implementing Botnets create great challenges to those who try to detect them. In order to better understand these challenges, this work proposes an architecture to map the behavior of botnets. For this, a topology was created with several components, such as Network Intrusion Detection System (NIDS) and Host Intrusion Detection System (HIDS), aided with information from honeypots for the detection and analysis of attacks. This approach enabled real data to be obtained from attempts, some successfully, from Malware infections, with the aim of transforming systems into Bots and integrating them into Botnets. An exploratory analysis of the data is performed to verify the detection capabilities and the cases where the components do not provide correct information. Some methods based on machine learning were also used to process and analyze the collected data.

Nowadays, more and more services are dependent on the use of resources hosted on the web. The realization of operations such as access to the account bank, credit card operations, among other operations, is something increasingly common in current times, demonstrating not only human dependence on the internet connection, as well as the need to adapt the web resources to the daily life of society. As a result of this growing dependency, web resources now provide a greater amount of confidential information, making the risk of a cyberattack and information leaking grow considerably. In the web context, one of the most well-known attacks is SQL injection that allows the attacker to exploit, through the injection of malicious queries, access to confidential information. This paper suggests a solution for the detection of SQL injection via web resources, using the analysis of the logs of the executed queries.

The evolution of technology and the increasing connectivity between devices lead to an increased risk of cyberattacks. Reliable protection systems, such as Intrusion Detection System (IDS) and Intrusion Prevention System (IPS), are essential to try to prevent, detect and counter most of the attacks. However, the increased creativity and type of attacks raise the need for more resources and processing power for the protection systems which, in turn, requires horizontal scalability to keep up with the massive companies’ network infrastructure and with the complexity of attacks. Technologies like machine learning, show promising results and can be of added value in the detection and prevention of attacks in near real-time. But good algorithms and tools are not enough. They require reliable and solid datasets to be able to effectively train the protection systems. The development of a good dataset requires horizontal-scalable, robust, modular and faulttolerant systems so that the analysis may be done in near real-time. This work describes an architecture design for horizontal-scaling capture, storage and analyses, able to collect packets from multiple sources and analyse them in a parallel fashion. The system depends on multiple modular nodes with specific roles to support different algorithms and tools.

Nowadays, everything is recorded and shared using electronic devices. However, most people don’t apply security measures to safeguard their information. This is a major problem in the enterprise environment since people go to work and connect their devices to their company’s network. It takes only one infected smartphone or computer to compromise the entire company. Therefore, security is a crucial point in a business’ management, especially regarding its network. But this is not an easy thing to do since the security field is constantly changing and evolving to overcome problems and vulnerabilities that are discovered every day. The work to be presented is one that attempts to overcome some of these problems. It uses Software Defined Networking (SDN) concepts to improve network security in the enterprise environment. This thesis presents a system with several security elements, each one tackling a different problem. Making use of honeypots technology, the system developed not only identifies attacks but can also create decoys to attackers in order to extract information to improve the already existing security measures.