Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation

Area of Science:

• Cybersecurity
• Internet of Things (IoT) Security
• Network Intrusion Detection

Background:

• Advanced Persistent Threats (APTs) pose significant, concealed threats to IoT systems.
• Existing detection methods lack comprehensive and prompt recognition capabilities for APT activities in IoT environments.
• High data transmission costs hinder effective cyber situation comprehension in distributed IoT systems.

Purpose of the Study:

• To propose a novel APT Alerts and Logs Correlation Method (APTALCM) for enhanced IoT security.
• To develop a framework for deploying APTALCM using edge computing for efficient cyber situation comprehension.
• To accurately recognize APT attack intentions within IoT systems.

Main Methods:

• Developed a cyber situation ontology for formalizing APT attack activities in IoT.
• Implemented a SimRank-based similarity measurement for correlating APT alerts and logs.
• Proposed Alert Instance Correlation Module (AICM) and Log Instance Correlation Module (LICM) for scenario reconstruction and log community detection.

Main Results:

• APTALCM effectively achieves cyber situation comprehension by recognizing APT attack intentions.
• The AICM and LICM modules demonstrate a high true-positive rate and a low false-positive rate.
• Edge computing architecture minimizes data transmission costs while enabling effective threat detection.

Conclusions:

• APTALCM provides a comprehensive and prompt solution for detecting APT activities in IoT systems.
• The proposed method enhances cybersecurity posture by enabling accurate identification of attack intentions.
• The framework's edge computing approach is crucial for scalable and cost-effective IoT security.