[en] Since the introduction of the first Programmable Logic Controllers (PLCs) in the 1960s, Industrial Control Systems (ICSs) have evolved vastly. From the primitive isolated setups, ICSs have progressively become more interconnected, forming the complex networked environments known today as industrial networks. These systems are responsible for a wide range of physical processes, including those belonging to Critical Infrastructures (CIs). As a result, securing industrial networks is critical to the well-being of modern societies. Traditional network architectures pose significant challenges in securing industrial networks due to several reasons. Firstly, they exhibit limited automation, heavily relying on manual configuration processes which are slow to adapt and prone to human error, thereby hindering dynamic security adjustments in ICS environments. Secondly, these architectures employ device-centric management, leading to intricate configurations and restricted visibility across the entire network, complicating the identification and isolation of security threats. Thirdly, they lack centralized control, as the control plane and data plane are tightly coupled within network devices, impeding a holistic security posture and making it complex to enforce consistent network-wide configurations. To overcome these limitations, Software-Defined Networking (SDN) emerges as a solution to address the challenges faced by traditional network architectures in industrial networks. SDN transforms network management by separating the control plane (network intelligence) from the data plane (data forwarding). This separation enables centralized, programmatic control over the network, offering an opportunity to enhance ICS security. In addition, this centralized approach provides real-time and network-wide visibility and programmability, which is useful for network monitoring, threat detection, and threat response capabilities. The main objective of this thesis is to demonstrate the feasibility of using SDN to develop intrusion response strategies specifically tailored to the ICS domain. This thesis aims to fill this gap by presenting two main contributions: (1) a proactive network packet attribute randomization approach against reconnaissance attacks, and (2) a proactive and adaptive network packet replication approach that mitigates False Data Injection (FDI) attacks. We experimentally validate the approaches by building ICS networks in test environments and analyzing the data generated by them. Based on this need to conduct ICS security research in a rigorous and reproducible environment, we analyze the feasibility of the MiniCPS framework for this purpose.

[eu] 1960ko hamarkadan lehenengo Kontrolatzaile Logiko Programagarriak (PLCak) sortu zirenetik, Industria Kontrolerako Sistemak (ICSak) asko eboluzionatu dute. Konfigurazio isolatu eta primitiboetatik hasita, gero eta interkonektatuagoak bihurtu dira, poliki-poliki gaur egun ezagutzen ditugun sare industrial konplexuak osatuz. ICSek prozesu fisiko ugari kontrolatzen dituztenez, Azpiegitura Kritikoak (CI) barne, sare industrialen segurtasuna bermatzea funtsezkoa da gizartearen ongizaterako. Sare-arkitektura tradizionalek erronka handiak aurkezten dituzte sare industrialen segurtasuna bermatzeko hainbat arrazoirengatik. Lehenik eta behin, automatizazio mugatua dute, neurri handi batean eskuzko konfigurazio-prozesuetan oinarritzen dira, aldaketa moteletara eta erroreen menpe egonez. Bigarrenik, arkitektura hauek gailuetan zentratutako kudeaketa erabiltzen dute, eta horrek konfigurazio konplexuak eta sare osoaren ikusgarritasun mugatua dakartza, segurtasunmehatxuen identifikazioa eta isolamendua zailduz. Hirugarrenik, ez dute kontrol zentralizaturik, kontrol-planoa eta datu-planoa sare-gailuetan loturik daudelako, eta horrek segurtasun-ikuspegi holistikoa eragoztu eta konfigurazioak sare osoan ezartzea konplexu bihurtzen ditu. Muga hauek gainditzeko, Softwarez Definituriko Sareak (SDN) irtenbide gisa agertzen dira sare industrialetan sare arkitektura tradizionalek dituzten erronkei aurre egiteko. SDNk sarearen kudeaketa eraldatzen du kontrol-planoa (sarearen inteligentzia) eta datu-planoa (datuen birbidalketa) banatuz. Banaketa honek sarearen gaineko kontrol zentralizatua eta programatikoa ahalbidetzen du, ICSen segurtasuna bermatzeko aukera emanez. Gainera, sarearen ikuspegi zentralizatuak sare osoko ikusgarritasuna eta programagarritasuna hobetzen ditu, sarearen monitorizaziorako, mehatxuen detekziorako eta mehatxuen erantzunerako gaitasuna emanez. Tesi honen helburu nagusia SDN erabiltzearen bideragarritasuna erakustea da, ICSetan erasoen aurkako erantzun-estrategiak garatzeko. Tesi honek bi ekarpen nagusi aurkezten ditu: (1) errekonozimendu erasoen aurkako sarepaketeen atributuen ausazko aldaketa proaktiboa, eta (2) sare-paketeen erreplikazio proaktibo eta adaptatiboa, Datu Faltsuen Injekzio (FDI) erasoak mitigatzeko. Proposamen hauek esperimentalki balioztatzen dira ICS sareak probatzeko inguruneak eraikiz eta hauek sorturiko datuak aztertuz. ICS segurtasun ikerketa ingurune fidagarri eta erreproduzigarrian egitearen beharra ikusita, MiniCPS herramintaren bideragarritasuna ere aztertzen dugu helburu horretarako.