Positional: A Dual-layer Collaborative Host-based Architecture for Securing Industrial Networks

This paper presents a security information distribution architecture that allows decentralised adaptation and response to security threats. The inspiration for this work and its underlying principles lie in the human immune system and its mechanisms for adapting to and sharing information about threats. The architecture assumes that the network is heterogeneous and contains low-level controllers (such as Siemens programmable logic controllers) as well as computers running conventional operating systems. It attempts to reduce computational overhead on components that are limited in resources and to exploit computational capacity where there is excess. In part this is achieved by using a set of metrics to measure damage that are analysed locally and distributed.Collated input data is forwarded by less capable devices and processed by higher performance (trusted) components to produce analytical models and recovery models.