SEADETEC: Advanced Service for Early Detection of Cybersecurity Events

Abstract

The transition towards Industry 4.0 has intensified interconnectivity by incorporating advanced technologies in industrial networks, servers, and the cloud. As a result, these systems are exposed to critical security challenges, such as unauthorized access to sensitive data and sabotage. In this scenario, current systems, including intrusion detection systems and security information and event management systems, face limitations in detecting new threats and in their compatibility with architectures other than x64/x86. To address these challenges, complex event processing (CEP) emerges as an effective solution, enabling early and real-time detection of cyberattacks in operational technology (OT) and Internet of Things (IoT) environments, adapting to the resource constraints of these devices. This study presents the design of an architecture aimed at OT and IoT, implementing CEP on ARM devices to enhance early detection of cyberattacks. The proposed system captures network traffic and processes it through a CEP engine to automatically identify anomalous patterns. Additionally, the system incorporates machine learning to detect new anomalies in realtime, improving both security and operational efficiency. The validation of the system will be demonstrated in a real environment by integrating it into MINERVA navigation and bridge system from Navantia S.M.E., illustrating its practical applicability in critical infrastructures.