Linking Intrusion Detection System Information and System Model to Redesign Security Architecture

Cyber Security is becoming more important in system design due to the increase of network connections and information exchange between systems. This leads to new requirements about security in the context of Internet of Things (IoT) and Industry 4.0 (I4.0). Security by Design is a crucial method in system engineering to consider; it reduces the security risk at an early stage of system development. Using this method, a system model with a security architecture is created with initial security measures. After the design phase is completed, previously not considered attacks on the running system cannot be covered. Thus, it is important to monitor the security during the continuous operation of the system. This continuous monitoring can be performed, for instance, by an Intrusion Detection System (IDS), which can detect anomalies in communication traffic. A major challenge, however, is to evaluate the detected anomalies and identify the possibly unknown system vulnerabilities. To overcome this challenge, we present an approach to analyze the system's IDS information together with the model information in order to identify the security vulnerabilities. As outcome, not-considered threats and attacks can be treated and necessary security measures can be derived. This supports the redesign of the system including the security architecture.