Portaledge is a Digital Bond research project that uses OSIsoft’s PI server to aggregate security events, correlate these events, and detect cyber security attacks. It is funded by the Department of Energy.

We have a major shift in our approach to this project. The initial approach was to generate meta events through a series of expert systems approaches. It was a two-tiered taxonomy with events and meta events. This approach was working, but we didn’t feel it was getting the coverage we had hoped for. So we have moved to a composite approach that is discussed in detail in SCADApedia Portaledge Event Taxonomy pages.

In brief, the new, hierarchical composite approach is:

Each Event, Event Class Event and Meta Event will have its own correlation rules based on appropriate commonalities. A time period is an example of a simple commonality. Source IP is another example.

Other advantage of this approach is interim results and selective event class deployment. For example, our initial efforts are on the Availability, Reconnaissance and Enumeration Event Classes, and we will be able to issue those as separate ACE templates.

Asset owners will be able to implement one or all of the Event Classes. For example, we believe the Availability Event Class will be very popular in this control system space. So an asset owner with PI could download and implement just the Availability class and use PI to identify when workstations, servers, routers/switches, PLC’s, etc. performance is degraded.

This approach also raises the issue of confidence in any identified attack. The length of chains is a crude measure of confidence, and we will be considering more sophisticated and accurate methods. The confidence measure could include the variety of data sources and Event / Event Class Events in the chain. The confidence measure could be based on Events and Event Class Events that themselves have differing levels of confidence. It is an interesting work in progress.

Next week will blog in more detail on the Availability Event Class to illustrate the Event Taxonomy and also highlight what will be the first part of Portaledge that will be released.