ADEPT: Detection and Identification of Correlated Attack Stages in IoT Networks,IEEE Internet of Things Journal |
您所在的位置：网站首页 › adeptin和adeptat › ADEPT: Detection and Identification of Correlated Attack Stages in IoT Networks,IEEE Internet of Things Journal |
ADEPT: Detection and Identification of Correlated Attack Stages in IoT Networks,IEEE Internet of Things Journal
|
The fast-growing Internet-of-Things (IoT) market has opened up a large threat landscape, given the wide deployment of IoT devices in both consumer and commercial spaces. Attacks on IoT devices generally consist of multiple stages and are dispersed spatially and temporally. These characteristics make it challenging to detect and identify the attack stages using solutions that tend to be localized in space and time. In this work, we present Adept
, a distributed framework to detect and identify the individual attack stages in a coordinated attack. Adept works in three phases. First, network traffic of IoT devices is processed locally for detecting anomalies with respect to their benign profiles. Any alert corresponding to a potential anomaly is sent to a security manager, where aggregated alerts are mined, using frequent itemset mining (FIM), for detecting patterns correlated across both time and space. Finally, using both alert-level and pattern-level information as features, we employ a machine learning approach to identify individual attack stages in the generated alerts. We carry out extensive experiments, with emulated and realistic network traffic; the results demonstrate the effectiveness of the proposed framework in terms of its ability in attack-stage detection and identification.
中文翻译：
鉴于物联网设备在消费者和商业空间中的广泛部署，快速发展的物联网（IoT）市场开辟了巨大的威胁格局。对物联网设备的攻击通常包括多个阶段，并且在空间和时间上分散。这些特征使得使用倾向于时空定位的解决方案来检测和识别攻击阶段具有挑战性。在这项工作中，我们介绍善于 ，一种分布式框架，用于检测和识别协同攻击中的各个攻击阶段。 善于分三个阶段工作。首先，物联网设备的网络流量在本地进行处理，以检测其良性配置文件的异常。对应于潜在异常的任何警报都将发送到安全管理器，在安全管理器中，将使用频繁项集挖掘（FIM）来挖掘汇总警报，以检测跨时间和空间相关的模式。最后，将警报级别和模式级别的信息用作功能，我们采用机器学习方法来识别生成的警报中的各个攻击阶段。我们进行了模拟和逼真的网络流量的广泛实验；结果证明了所提出框架在攻击阶段检测和识别方面的有效性。 |
【本文地址】