Hardware based aggregation and integrated analysis of end system network traffic for the security of industrial networks

Increasing cybersecurity threats in industrial networks highlight the need for more advanced network traffic analysis methods to ensure the security of these systems. In this study, a hardware-based system was designed to analyze network traffic and detect potential threats. The primary objective of the study was to enhance network security in industrial environments by conducting real-time analysis and establishing an effective defense mechanism against potential attacks. Within the scope of the thesis, signature-based algorithms were integrated to examine the relationship between network traffic characteristics and anomalous behaviors. The system successfully differentiated between malicious and normal traffic. The dataset used for the study was composed of real network traffic data, which was utilized for both attack detection and normal traffic analysis. In this thesis, a hardware-based traffic monitoring system is developed and this system is made ready for rule-based decision making mechanisms by integrating AlienVault and GreyNoise APIs. The findings demonstrated that the developed system achieved high accuracy rates in threat detection while maintaining low packet analysis times, meeting the requirements for real-time analysis. This study provides an innovative approach to integrating hardware-based methods for the security of industrial networks. The results obtained offer valuable insights for future research in the domain.