SERUM: A Lightweight Approach for Secure Network Route Monitoring in Industrial Networks Future industrial networks are envisioned to deploy different application controls of cyberphysical systems (CPS) on a shared network infrastructure. However, to avoid interference between the control loops, knowledge about the current utilization of the used network resources is necessary. Since such information is critical for control decisions and the network behavior, they become a potential attack surface.We introduce Secure Network Route Monitoring (SERUM), a lightweight approach to make the current network state partially transparent to the applications. In SERUM, monitoring information of each router on a specific communication path are collected in one roundtrip. Using a chain of nested message authentication codes, the data integrity and communication context are protected. The evaluation of our prototype has shown its low overhead and scalability regarding the network path length.

bwNetFlow: A Customizable MultiTenant Flow Processing Platform for Transit Providers In times of increasing bandwidth demands, network operators strive for increased visibility of their networku0027s utilization as well as an indication of the legitimacy of traffic processed across network nodes. Additionally, the detection and mitigation of illegitimate or malicious traffic such as denial of service attacks remains a current and persistently active field of research. Flowbased network monitoring can provide this information live from any network interface. This paper introduces a flow processing platform meant to receive flow information from border interfaces and distribute the acquired information to specialized applications. Transit providers deploying our platform can use this information directly, but also provide all interested customers or network entities with the specific subset concerning them. Between collecting and redistributing the flow information, our platform offers different methods of enrichment using a variety of sources allowing for views superior to plain Netflow records. However, a provided tool can reencode and reexport standard Netflow to ensure compatibility and allow for seamless integration of customerspecific streams into preexisting setups. This platformu0027s components allow the enrichment, division and anonymization of flow data to a number of highly customized streams for any type of application, either on a customerspecific or a networkwide provider level. Applications include the conversion of flow data for timeseries databases and the accompanying dashboards, the detection of DDoS attacks or other hightraffic situation on any network level, the identification of faulty network routing policies, or any other use case conceivable on regular flow data, but within an arbitrary network scope.