IAM based Audit Framework to enhance and protect the Critical Infrastructure for Distributed System

Abstract

Manufacturing facilities, transportation networks, energy distribution networks, and power plants are all examples of Critical Infrastructure (CI) that modern communities depend on to provide goods and services. Due to their size, complexity, and unique features, these CIs frequently require the assistance of Industrial Automation and Control Systems (IACS). IACS manages assets and administers day-to-day activities. With additional processes and networked monitoring and controlling devices, the attack surface of the underlying CIs grows in these increasingly complex IACS.  To establish and discern the correlation between worldwide concerns concerning Critical Infrastructure Protection (CIP) and cybersecurity. In order to support the economy and security interests, it is necessary to guarantee that systems, goods, and services are sufficiently reliable and resilient. This circumstance necessitates the development of new ways based on advanced data analytics techniques that can extract insights from the CI to enhance Critical Infrastructure Protection (CIP) frameworks. This paper introduces a proposed IAM-based audit framework that integrates capabilities for forensic investigation and audit compliance through effective architectural functions within security systems. The framework incorporates algorithms such as data acquisition and domain processors. The data acquisition algorithm processes a substantial dataset, comprising organized data for cloud identity and access management systems, including AWS, Azure, and Google Cloud datasets. It employs a DMA process to evaluate system performance metrics such as perceived data rate, ingested rate, and consumed rate. Afterward, the domain processor computes the data event by utilizing the determined ingested event as input. By changing the number of nodes or clients from 3 to 10, the suggested framework can help find the biggest event that is ingested, the longest time it takes to compute, and the shortest time it takes to compute. This article also introduces the Interruption and Abnormality-based Identification System (IAIS), a novel architecture designed to enhance Critical Infrastructure Protection (CIP) globally. By integrating forensic readiness and compliance auditing, IAIS addresses challenges in post-incident investigation and real-time monitoring. Its cloud-native design ensures scalability, making it a vital tool for safeguarding critical systems against evolving cyber threats Furthermore, this experimental evaluation also demonstrated the utility of the suggested framework in detecting common sequences of attacks.