Abstract: With the explosive growth in the number of IoT devices,the means of attacking IoT devices have also become diverse and covert.Machine learning-based detection methods have been actively researched and shown great potential.However,these models are considered black boxes,making it difficult to explain their classification results and thus unable to explain the specific means and patterns of IoT threats.To address this issue,this paper constructs a technology-feature dictionary based on ATT&CK framework,characterizing attack techniques with traffic features,and builds a threat-technology database,decomposing network threats into the level of attack techniques.This paper designs a threat detection model based on an efficacy mechanism,constructs a real-time traffic feature matrix,summarizes the attack techniques suffered by the traffic,and inputs the technical sequence into the threat-technology database to obtain the possible threats and their probabilities.Experimental results show that the proposed model achieves a threat detection rate as high as 99.595% in the dataset,which is compared to traditional methods.Moreover,it can adjust the false positive rate according to the experimental environment and provides reliable attack path explanations for analysts.

Key words: IoT data flow, Threat detection, Efficacy mechanism, ATT&CK framework