计算机科学 ›› 2025, Vol. 52 ›› Issue (6): 397-404.doi: 10.11896/jsjkx.240400133
孙瑞杰1, 李鹏1,2,3, 朱枫1
SUN Ruijie1, LI Peng1,2,3, ZHU Feng1
摘要： 随着物联网设备的数量呈爆炸性增长,针对物联网设备的攻击手段也开始变得多样且隐蔽。基于机器学习的检测方法已经得到广泛的研究,并具有巨大的潜力。然而,这些模型被认为是黑匣子,很难解释其分类结果,因此无法说明物联网威胁特有的手段与模式。为了解决这个问题,文中基于ATT&CK框架,构建了技术-特征字典,将攻击技术进行了流量的特征化描述;并构建了威胁-技术数据库,将网络威胁分解到了攻击技术层面。文中设计了基于致效机理的威胁检测模型,构建了实时流量特征矩阵,归纳了流量受到的攻击技术,将技术序列代入威胁-技术数据库,得到可能受到的威胁及其概率。实验结果表明,所提模型对于数据集中的威胁检测率高达99.595%,与传统方法效果相当,并且可以根据实验环境需要调节误报率,为分析人员提供了可靠的攻击路径解释。
中图分类号:
| [1]SHANG Y,LI P,ZHU F,et al.Overview of IoT traffic attack detection technology based on fuzzy logic[J].Computer Science,2024,51(3):3-13. [2]ANITHA V,KUMAR C G N,KUCHIPUDI R,et al.Cybersecurity in Internet of Things Networks using Deep Learning Models[C]//2023 International Conference on Sustainable Computing and Data Communication Systems(ICSCDS).IEEE,2023:1090-1095. [3]DIRO A,CHILAMKURTI N,NGUYEN V D,et al.A comprehensive study of anomaly detection schemes in IoT networks using machine learning algorithms[J].Sensors,2021,21(24):8320. [4]DEORANKAR A V,THAKARE S S.Survey on anomaly detec-tion of(iot)-internet of things cyberattacks using machine lear-ning[C]//2020 Fourth International Conference on Computing Methodologies and Communication(ICCMC).IEEE,2020:115-117. [5]GU Z,WANG Z,GUO J,et al.5G power failure terminal threat detection based on atomized zero-trust component[J].Computer Engineering,2023,49(2):161-168. [6]DING D,SAVI M,SIRACUSA D.Tracking normalized network traffic entropy to detect DDoS attacks in P4[J].IEEE Transactions on Dependable and Secure Computing,2021,19(6):4019-4031. [7]VUGRIN E D,HANSON S,CRUZ J,et al.Experimental Validation of a Command and Control Traffic Detection Model[J].IEEE Transactions on Dependable and Secure Computing,2023,21(3):1084-1097. [8]HAJI S H,AMEEN S Y.Attack and anomaly detection in IoTnetworks using machine learning techniques:A review[J].Asian Journal of Research in Computer Science,2021,9(2):30-46. [9]XIAO X,XIAO W,LI R,et al.EBSNN:Extended byte segment neural network for network traffic classification[J].IEEE Transactions on Dependable and Secure Computing,2021,19(5):3521-3538. [10]QIU X,ZHANG L,REN Y,et al.Ensemble deep learning forregression and time series forecasting[C]//2014 IEEE Sympo-sium on Computational Intelligence in Ensemble learning(CIEL).IEEE,2014:1-6. [11]XIONG W,LEGRAND E,ÅBERG O,et al.Cyber security threatmodeling based on the MITRE Enterprise ATT&CK Matrix[J].Software and Systems Modeling,2022,21(1):157-177. [12]AL-SHAER R,SPRING J M,CHRISTOU E.Learning the associations of mitre att & ck adversarial techniques[C]//2020 IEEE Conference on Communications and Network Security(CNS).IEEE,2020:1-9. [13]GEORGIADOU A,MOUZAKITIS S,ASKOUNIS D.Assessing mitre att&ck risk using a cyber-security culture framework[J].Sensors,2021,21(9):3267. [14]KWON R,ASHLEY T,CASTLEBERRY J,et al.Cyber threatdictionary using mitre att&ck matrix and nist cybersecurity framework mapping[C]//2020 Resilience Week(RWS).IEEE,2020:106-112. [15]HAQUE M A,SHETTY S,KAMHOUA C A,et al.Adversarial Technique Validation & Defense Selection Using Attack Graph & ATT&CK Matrix[C]//2023 International Conference on Computing,Networking and Communications(ICNC).IEEE,2023:181-187. [16]NOUR M.The UNSW-NB15 Dataset [EB/OL].https://paperswithcode.com/dataset/unsw-nb15. |
|
||
首页