20.500.12556/RUL-180953 Upravljanje varnostnih dogodkov v procesnih omrežjih Security Information and Event Management in Process Networks Kibernetska varnost v procesnih omrežjih je zaradi digitalizacije industrijskih okolj vse bolj ključnega pomena. Nadzorni sistemi, kot je SCADA, upravljajo kritično infrastrukturo, zato so zanesljivo delovanje, razpoložljivost podatkov in preprečevanje nepooblaščenih dostopov nujni za varno in stabilno obratovanje. V diplomskem delu smo obravnavali osnovne značilnosti procesnih omrežij, varnostne standarde in pristope zaščite, s poudarkom na segmentaciji omrežja in uporabi modela Purdue. Osrednji del dela predstavlja vzpostavitev izoliranega testnega okolja VMware Workstation, kjer smo uporabili odprtokodno platformo Wazuh kot rešitev za spremljanje in upravljanje varnostnih dogodkov (angl. Security Information and Event Management, SIEM). V testno okolje smo vključili Linux in Windows napravi kot tarči napadov ter Kali Linux kot napadalno napravo. Vse te naprave služijo kot delovne postaje, ki v okolju operacijskih tehnologij (angl. Operational Technology, OT) omogočajo nadzor, vizualizacijo ali administracijo. S simuliranjem napadov, kot so neuspešne SSH prijave, brute-force napadi, posegi v celovitost datotek in prenos testne zlonamerne vsebine EICAR, smo preverili učinkovitost zaznavanja in obravnave varnostnih incidentov. Rezultati so pokazali, da Wazuh omogoča zanesljivo spremljanje nadzorovanih sistemov in hitro zaznavo anomalij, kar bistveno pripomore k zgodnjemu odkrivanju kibernetskih groženj v OT-okolju. Pridobljeni rezultati potrjujejo, da integracija SIEM rešitev v procesna omrežja predstavlja pomemben korak k večji kibernetski odpornosti industrijskih sistemov. Cybersecurity in process control networks has become increasingly critical due to the rapid digitalization and interconnection of industrial environments. Industrial Control Systems, including SCADA systems, manage essential infrastructure where system availability, data integrity, and secure access are fundamental requirements for safe and reliable operations. This thesis examines the characteristics of process control networks, security standards, and protection methods, with a focus on network segmentation and the Purdue reference model. The practical part of the thesis presents the creation of an isolated virtual environment in VMware Workstation, where the open-source SIEM platform Wazuh was deployed for centralized event monitoring and threat detection. The experimental environment consisted of Linux and Windows target systems and a Kali Linux attacker machine. All these devices serve as workstations that provide control, visualization, or administration in the OT environment. By simulating attacks such as failed SSH logins, brute-force attempts, file integrity tampering, and the execution of the EICAR test malware, the detection and response capabilities of the Wazuh platform were evaluated. The experimental results confirmed that Wazuh enables reliable monitoring, timely detection of security anomalies, and enhanced situational awareness in OT environments. Findings indicate that integrating SIEM solutions into process control networks plays an essential role in strengthening cybersecurity and supporting industrial systems in defending against modern cyber threats. kibernetska varnost procesna omrežja SCADA SIEM Wazuh OT cybersecurity process control networks SCADA SIEM Wazuh OT true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2026-03-20 12:00:04 2026-03-20 12:00:19 2026-04-09 13:36:06 0000-00-00 00:00:00 2026 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 62900 274706179 Didic_Blaz_-_Upravljanje_varnostnih_dogodkov_v_procesnih_omrezjih.pdf Didic_Blaz_-_Upravljanje_varnostnih_dogodkov_v_procesnih_omrezjih.pdf 1 163C17D7C63E5525F8982489DDAE69F1 884801359b865d4d7c11cad19ec52d9ea4a332a60c51380fd607ddde8a0170dc e562c16a-244b-11f1-b0ab-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=230976 Fakulteta za elektrotehniko 0 0 0