Kernel-Level Event Logging for ICS Data Provenance

The system segments the industrial control network into multiple computing devices (PLCs, RTUs, HMIs, servers) and implements logging agents on each device independently. Each agent captures kernel-level events locally and transmits them to a centralized server, allowing granular security monitoring without requiring complete system redesign. This segmentation enables precise security tracking while maintaining individual device functionality and reducing overall system complexity.

A centralized logging server acts as an intermediary that receives, aggregates, and processes kernel-level events from multiple computing devices. The server consolidates security-relevant events, correlates them across devices, and generates comprehensive security reports. This intermediary approach centralizes the complexity of security analysis while keeping individual computing devices relatively simple, resolving the contradiction between monitoring precision and system complexity.

The logging agents on each computing device are configured to capture only security-relevant kernel-level events (such as authentication attempts, file access, registry changes) rather than all system events. This selective event capture reduces processing overhead and resource consumption while maintaining fast threat detection capability for security-critical operations. The local quality principle ensures that each device processes only the events necessary for security monitoring.

The system implements partial logging by focusing on specific kernel-level events that are most indicative of security threats, rather than logging all possible system events. The logging agents use predefined filters and monitoring rules to capture only relevant events (e.g., unauthorized access attempts, suspicious process executions). This partial action approach achieves fast threat detection for critical security events while minimizing processing overhead and resource consumption.