<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>0123-7799</journal-id>
<journal-title><![CDATA[TecnoLógicas]]></journal-title>
<abbrev-journal-title><![CDATA[TecnoL.]]></abbrev-journal-title>
<issn>0123-7799</issn>
<publisher>
<publisher-name><![CDATA[Instituto Tecnológico Metropolitano - ITM]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S0123-77992020000200243</article-id>
<article-id pub-id-type="doi">10.22430/22565337.1586</article-id>
<title-group>
<article-title xml:lang="es"><![CDATA[Predicción de ciberataques en sistemas industriales SCADA a través de la implementación del filtro Kalman]]></article-title>
<article-title xml:lang="en"><![CDATA[Predicting Cyber-Attacks in Industrial SCADA Systems Through The Kalman Filter Implementation]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Tascón]]></surname>
<given-names><![CDATA[Stephen Quiroz]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Jiménez]]></surname>
<given-names><![CDATA[Julián Zapata]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Montoya]]></surname>
<given-names><![CDATA[Héctor Fernando Vargas]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Instituto Tecnológico Metropolitano  ]]></institution>
<addr-line><![CDATA[Medellín ]]></addr-line>
<country>Colombia</country>
</aff>
<aff id="Af2">
<institution><![CDATA[,Instituto Tecnológico Metropolitano  ]]></institution>
<addr-line><![CDATA[Medellín ]]></addr-line>
<country>Colombia</country>
</aff>
<aff id="Af3">
<institution><![CDATA[,Instituto Tecnológico Metropolitano  ]]></institution>
<addr-line><![CDATA[Medellín ]]></addr-line>
<country>Colombia</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>08</month>
<year>2020</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>08</month>
<year>2020</year>
</pub-date>
<volume>23</volume>
<numero>48</numero>
<fpage>243</fpage>
<lpage>261</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://www.scielo.org.co/scielo.php?script=sci_arttext&amp;pid=S0123-77992020000200243&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.co/scielo.php?script=sci_abstract&amp;pid=S0123-77992020000200243&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.co/scielo.php?script=sci_pdf&amp;pid=S0123-77992020000200243&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="es"><p><![CDATA[Resumen En los sistemas industriales SCADA (Supervisory Control And Data Acquisition), conocer el estado de cada dispositivo permite obtener información de su comportamiento. De esta forma se pueden deducir acciones y conformar estrategias diferentes que ayuden a reducir el riesgo cibernético. En este artículo de investigación aplicada, se presenta un modelo de predicción de posibles ciberataques en un sistema SCADA. Dicha predicción se hace con un filtro Kalman. Un filtro Kalman procesa los eventos de ciberseguridad capturados a través de un sistema de detección de intrusos (aplicado en un sistema de simulación de SCADA) y genera una proyección futura de la probabilidad de que se consolide un ataque. Con esta información, los administradores de sistemas podrán tomar alguna decisión sobre cómo actuar frente a inminentes ataques informáticos. Se realizó una instalación de diferentes componentes tecnológicos y se ejecutaron 3 ataques informáticos al SCADA: (i) posibles escaneos, (ii) robo de información y (iii) sobrescritura de comandos y datos generando Denial of Service o DoS. los eventos de seguridad fueron detectados por un sistema de detección de intrusos y enviados a un software configurado con las características del filtro Kalmanpara entregar como salida las posibles predicciones de ataques. Como resultado, se puede ver cómo a partir de las entradas es posible conocer la probabilidad de que un ataque informático sea exitoso con base en los eventos históricos y las fórmulas aplicadas del filtro.]]></p></abstract>
<abstract abstract-type="short" xml:lang="en"><p><![CDATA[Abstract In industrial SCADA (Supervisory Control and Data Acquisition) systems, knowing the status of each device allows information to be collected on its behavior. In this way, actions can be deduced, and different strategies can be formed to help reduce cyber risk. In this article of applied research, a model of prediction of possible cyber-attacks in a SCADA system is presented. This prediction is made with a Kalman filter. A Kalman filter processes cyber security events captured through an intrusion detection system (applied in a SCADA simulation system) and generates a future projection of the probability of an attack being carried out. With this information, system administrators will be able to make some decisions about how to act against imminent cyber-attacks. An installation of different technological components was carried out and 3 cyberattacks to the SCADA were executed: (i) possible scans, (ii) theft of information and (iii) command and data overwriting generating Denial of Service or DoS. The security events were detected by an intrusion detection system and sent to a software, setup with Kalman filter features to deliver as output the possible predictions of attacks. As a result, the probability of a successful computer attack can be seen from the entries based on the historical events and the applied filter formulas.]]></p></abstract>
<kwd-group>
<kwd lng="es"><![CDATA[Ataque informático]]></kwd>
<kwd lng="es"><![CDATA[ciberseguridad]]></kwd>
<kwd lng="es"><![CDATA[filtro Kalman]]></kwd>
<kwd lng="es"><![CDATA[Control de supervisión y adquisición de datos]]></kwd>
<kwd lng="es"><![CDATA[sistema de detección de intrusos]]></kwd>
<kwd lng="en"><![CDATA[Cyber-attack]]></kwd>
<kwd lng="en"><![CDATA[cyber-security]]></kwd>
<kwd lng="en"><![CDATA[intrusion detection system]]></kwd>
<kwd lng="en"><![CDATA[kalman filter]]></kwd>
<kwd lng="en"><![CDATA[Supervisory Control and Data Acquisition]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<label>[1]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Almanza J.]]></surname>
<given-names><![CDATA[A. R.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[XIX Encuesta Nacional de Seguridad Informática Evolución del perfil del profesional de seguridad digital.]]></article-title>
<source><![CDATA[Rev, sistemas]]></source>
<year>2019</year>
<volume>151</volume>
<page-range>12-41</page-range></nlm-citation>
</ref>
<ref id="B2">
<label>[2]</label><nlm-citation citation-type="">
<collab>Instituto Nacional de ciberseguridad (INCIBE)</collab>
<source><![CDATA[Las claves de los últimos ataques en sistemas de control industrial]]></source>
<year>2018</year>
</nlm-citation>
</ref>
<ref id="B3">
<label>[3]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Ramirez]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Miilán]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Moreno]]></surname>
<given-names><![CDATA[V.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Herramienta para programar un controlador lógico programable basado en hardware reconfigurable]]></article-title>
<source><![CDATA[RIELAC]]></source>
<year>2011</year>
<volume>22</volume>
<page-range>65-77</page-range></nlm-citation>
</ref>
<ref id="B4">
<label>[4]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Romero-Acero]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Marín-Cano]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Arango-Zuluaga]]></surname>
<given-names><![CDATA[E. I.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Plataformas de Laboratorio de Bajo Costo Basadas en el Protocolo ZigBee]]></article-title>
<source><![CDATA[TecnoLógicas]]></source>
<year>2013</year>
<page-range>411-23</page-range></nlm-citation>
</ref>
<ref id="B5">
<label>[5]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Annor]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Pranggono]]></surname>
<given-names><![CDATA[B.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Development of Smart Grid Testbed with Low-Cost Hardware and Software for Cybersecurity Research and Education]]></article-title>
<source><![CDATA[Wirel. Pers. Commun.]]></source>
<year>2018</year>
<volume>101</volume>
<numero>3</numero>
<issue>3</issue>
<page-range>1357-77</page-range></nlm-citation>
</ref>
<ref id="B6">
<label>[6]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Carozo Blumsztein]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Vidal]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Sistemas SCADA, algunas recomendaciones de seguridad - Parte II]]></article-title>
<source><![CDATA[Revista. Seguridad]]></source>
<year>2013</year>
<numero>19</numero>
<issue>19</issue>
</nlm-citation>
</ref>
<ref id="B7">
<label>[7]</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Kalbfleisch]]></surname>
<given-names><![CDATA[D. J.]]></given-names>
</name>
</person-group>
<source><![CDATA[SCADA Technologies and Vulnerabilities]]></source>
<year>2013</year>
<page-range>1-7</page-range></nlm-citation>
</ref>
<ref id="B8">
<label>[8]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Coffey]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
<name>
<surname><![CDATA[Smith]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Maglaras]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
<name>
<surname><![CDATA[Janicke]]></surname>
<given-names><![CDATA[H.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Vulnerability Analysis of Network Scanning on SCADA Systems]]></article-title>
<source><![CDATA[Secur. Commun. Networks]]></source>
<year>2018</year>
<volume>2018</volume>
<page-range>1-21</page-range></nlm-citation>
</ref>
<ref id="B9">
<label>[9]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Sun]]></surname>
<given-names><![CDATA[C.-C.]]></given-names>
</name>
<name>
<surname><![CDATA[Hahn]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Liu]]></surname>
<given-names><![CDATA[C.-C.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Cyber security of a power grid: State-of-the-art]]></article-title>
<source><![CDATA[Int. J. Electr. Power Energy Syst.]]></source>
<year>2018</year>
<volume>99</volume>
<page-range>45-56</page-range></nlm-citation>
</ref>
<ref id="B10">
<label>[10]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Maglaras]]></surname>
<given-names><![CDATA[L. A.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Cyber security of critical infrastructures]]></article-title>
<source><![CDATA[ICT Express]]></source>
<year>Mar-</year>
<month>20</month>
<day>18</day>
<volume>4</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>42-5</page-range></nlm-citation>
</ref>
<ref id="B11">
<label>[11]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Liu]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Liu]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<source><![CDATA[Physical Intrusion Detection for Industrial Control System]]></source>
<year></year>
<conf-name><![CDATA[ 2018 IEEE Conference on Communications and Network Security (CNS),]]></conf-name>
<conf-date>2018</conf-date>
<conf-loc>Beijing </conf-loc>
<page-range>1-2.</page-range></nlm-citation>
</ref>
<ref id="B12">
<label>[12]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Warzynski]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Kolaczek]]></surname>
<given-names><![CDATA[G.]]></given-names>
</name>
</person-group>
<source><![CDATA[Intrusion detection systems vulnerability on adversarial examples]]></source>
<year></year>
<conf-name><![CDATA[ 2018 Innovations in Intelligent Systems and Applications (INISTA)]]></conf-name>
<conf-date>2018</conf-date>
<conf-loc>Thessaloniki </conf-loc>
<page-range>1-4</page-range></nlm-citation>
</ref>
<ref id="B13">
<label>[13]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Teja Gaddam]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Nandhini]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
</person-group>
<source><![CDATA[An analysis of various snort based techniques to detect and prevent intrusions in networks proposal with code refactoring snort tool in Kali Linux environment]]></source>
<year></year>
<conf-name><![CDATA[ 2017 International Conference on Inventive Communication and Computational Technologies (ICICCT)]]></conf-name>
<conf-date>2017</conf-date>
<conf-loc>Coimbatore </conf-loc>
<page-range>10-5</page-range></nlm-citation>
</ref>
<ref id="B14">
<label>[14]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Kalman]]></surname>
<given-names><![CDATA[R. E.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[A New Approach to Linear Filtering and Prediction Problems]]></article-title>
<source><![CDATA[J. Basic Eng.]]></source>
<year>1960</year>
<volume>82</volume>
<numero>82</numero>
<issue>82</issue>
<page-range>35-45</page-range></nlm-citation>
</ref>
<ref id="B15">
<label>[15]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Zuluaga-Ríos]]></surname>
<given-names><![CDATA[C. D.]]></given-names>
</name>
<name>
<surname><![CDATA[Álvarez-López]]></surname>
<given-names><![CDATA[M. A.]]></given-names>
</name>
<name>
<surname><![CDATA[Orozco-Gutiérrez]]></surname>
<given-names><![CDATA[A. A.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[A comparison of robust Kalman filtering methods for artifact correction in heart rate variability analysis]]></article-title>
<source><![CDATA[TecnoLógicas]]></source>
<year>2015</year>
<volume>18</volume>
<numero>34</numero>
<issue>34</issue>
<page-range>25-35</page-range></nlm-citation>
</ref>
<ref id="B16">
<label>[16]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Baker]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
<name>
<surname><![CDATA[Thennadil]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
</person-group>
<source><![CDATA[Constrained Kalman Filtering: Improving Fused Information Retention During Constraining]]></source>
<year></year>
<conf-name><![CDATA[ 2019 24th International Conference on Methods and Models in Automation and Robotics (MMAR)]]></conf-name>
<conf-date>2019</conf-date>
<conf-loc>Mi&#281;dzyzdroje, Poland </conf-loc>
<page-range>434-7</page-range></nlm-citation>
</ref>
<ref id="B17">
<label>[17]</label><nlm-citation citation-type="">
<collab>Python Software Foundation</collab>
<source><![CDATA[Python.org]]></source>
<year></year>
</nlm-citation>
</ref>
<ref id="B18">
<label>[18]</label><nlm-citation citation-type="">
<collab>Honeynet.org</collab>
<source><![CDATA[CONPOT - Low interaction serverside ICS honeypot]]></source>
<year>2019</year>
</nlm-citation>
</ref>
<ref id="B19">
<label>[19]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Jicha]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Patton]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Chen]]></surname>
<given-names><![CDATA[H.]]></given-names>
</name>
</person-group>
<source><![CDATA[SCADA honeypots: An in-depth analysis of Conpot]]></source>
<year></year>
<conf-name><![CDATA[ 2016 IEEE Conference on Intelligence and Security Informatics (ISI)]]></conf-name>
<conf-date>2016</conf-date>
<conf-loc>Tucson </conf-loc>
<page-range>196-8</page-range></nlm-citation>
</ref>
<ref id="B20">
<label>[20]</label><nlm-citation citation-type="">
<collab>MushMush Foundation Revision 1891107c</collab>
<source><![CDATA[Welcome to Conpot&#8217;s documentation!]]></source>
<year></year>
</nlm-citation>
</ref>
<ref id="B21">
<label>[21]</label><nlm-citation citation-type="">
<collab>Siemens 2008</collab>
<source><![CDATA[SIMATIC - Manual del sistema de automatización S7-200]]></source>
<year></year>
</nlm-citation>
</ref>
<ref id="B22">
<label>[22]</label><nlm-citation citation-type="">
<collab>Cisco</collab>
<source><![CDATA[SNORT Sotfware]]></source>
<year>2019</year>
</nlm-citation>
</ref>
<ref id="B23">
<label>[23]</label><nlm-citation citation-type="">
<collab>Barnyard2</collab>
<source><![CDATA[Bbarnyard2 Configuration]]></source>
<year></year>
</nlm-citation>
</ref>
<ref id="B24">
<label>[24]</label><nlm-citation citation-type="">
<collab>Oracle Corporation</collab>
<source><![CDATA[MySQL Workbench versions 5.6]]></source>
<year>2020</year>
</nlm-citation>
</ref>
<ref id="B25">
<label>[25]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Tovar]]></surname>
<given-names><![CDATA[S. A.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Balderas Conpot: honeypot de sistemas de control industrial]]></article-title>
<source><![CDATA[Revista .seguridad]]></source>
<year>2017</year>
<numero>29</numero>
<issue>29</issue>
</nlm-citation>
</ref>
<ref id="B26">
<label>[26]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Alhaidari]]></surname>
<given-names><![CDATA[F. A.]]></given-names>
</name>
<name>
<surname><![CDATA[AL-Dahasi]]></surname>
<given-names><![CDATA[E. M.]]></given-names>
</name>
</person-group>
<source><![CDATA[New Approach to Determine DDoS Attack Patterns on SCADA System Using Machine Learning]]></source>
<year></year>
<conf-name><![CDATA[ 2019 International Conference on Computer and Information Sciences (ICCIS)]]></conf-name>
<conf-date>2019</conf-date>
<conf-loc>Sakaka, Saudi Arabia </conf-loc>
<page-range>1-6</page-range></nlm-citation>
</ref>
<ref id="B27">
<label>[27]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[AL-Dahasi]]></surname>
<given-names><![CDATA[A. E. M.]]></given-names>
</name>
<name>
<surname><![CDATA[Abbas Saqib]]></surname>
<given-names><![CDATA[B. N.]]></given-names>
</name>
</person-group>
<source><![CDATA[Attack tree Model for Potential Attacks Against the SCADA System]]></source>
<year></year>
<conf-name><![CDATA[ 2019 27th Telecommunications Forum (TELFOR)]]></conf-name>
<conf-date>2019</conf-date>
<conf-loc>Belgrade, Serbia </conf-loc>
<page-range>1-4</page-range></nlm-citation>
</ref>
<ref id="B28">
<label>[28]</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[MeeraGandhi]]></surname>
<given-names><![CDATA[G.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Machine Learning Approach for Attack Prediction and Classification using Supervised Learning Algorithms]]></article-title>
<source><![CDATA[Int. J. Comput. Sci. Commun]]></source>
<year>2010</year>
<volume>1</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>247-50</page-range></nlm-citation>
</ref>
<ref id="B29">
<label>[29]</label><nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Abdelghani]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<source><![CDATA[Industrial control systems (ics) security in power transmission network]]></source>
<year></year>
<conf-name><![CDATA[ 2019 Algerian Large Electrical Network Conference (CAGRE)]]></conf-name>
<conf-date>2019</conf-date>
<conf-loc>Algiers </conf-loc>
<page-range>1-4</page-range></nlm-citation>
</ref>
</ref-list>
</back>
</article>
