Implementación de un correlacionador de eventos basado en software libre para la detección de ataques informáticos en la empresa eléctrica.

Abstract

This work aimed at implementing a free software-based event correlator to detect cyber-attacks at the Riobamba S.A Electric Power Enterprise, since even though, it has security devices like Firewall Check Point 4800, it does not have a centralized solution collecting, storing, and managing the information asset logs. To solve this issue, a comparative study has been done among several platforms, so Ubuntu-based Security Onion is the most appropriate. It was implemented in a HP Proliant server with two interfaces: the first one is for managing and the other one is for gathering the network traffic. SYSLOG was set up in network device to send logs towards the event correlator, and OSSEC agents were installed in the network assets. There were 2018 cyber-attacks reported by the event correlator in the results from January and Frebruary. Therefore, it was possible to determine that the main attacks were: denial of service and brute force attack with a total of 2049 and 1910 incidences respectively. China was the main source of attacks with a total of 1862. Of the results, it is concluded that the event correlator detects attacks properly in real time and at the same time generates the respective alerts. As consequence, the traffic circulating in the network was analyzed. It is recommended to continue to investigate and include the log process and standardization of SCADA system.