Implementation of a Framework for Early Anomaly Detection in Naval Systems

Abstract

The rapid digital transformation and the ongoing paradigm shift towards Industry 4.0 have significantly augmented interconnectivity through the integration of sophisticated technologies within industrial networks, server infrastructure, and cloud environments. Consequently, these interconnected systems are increasingly susceptible to critical security vulnerabilities, including illicit access to confidential information and acts of sabotage. Recognizing the limitations of existing security systems, including intrusion detection systems and security information and event management systems, in addressing novel threats, we propose complex event processing (CEP) as an effective countermeasure. CEP enables the timely and real-time detection of cyberattacks within operational technology (OT) and the Internet of Things (IoT) environments, exhibiting adaptability to the resource constraints of these devices. This work presents a framework of a specific architecture tailored for OT and IoT, implementing CEP on Advanced RISC Machine (ARM) devices to improve the early identification of cyber intrusions, including its human-machine interface (HMI). The proposed framework operates by capturing network traffic and processing it through a CEP engine to automatically identify anomalous patterns. The framework's efficacy is validated through its integration into Navantia's integrated bridge system within a real-world deployment.