XRecon:一个基于集体学习的Explainbale物联网侦察攻击检测系统
Mohammed M Alani1,2, Ernesto Damiani3
1Cybersecurity Research Lab, Toronto Metropolitan University, Toronto, ON M5B 2K3, Canada.
Sensors (Basel, Switzerland)
|June 10, 2023
概括
本研究介绍了一种机器学习系统,用于检测物联网 (IoT) 设备上的侦察攻击. 高效的系统达到99%的准确性,保护易受攻击的物联网设备免受早期的网络威胁.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 物联网 (IoT) 安全 安全 物联网
背景情况:
- 物联网 (IoT) 设备的扩散为恶意行为者创造了巨大的攻击面.
- 侦察攻击,包括扫描和信息收集,是诸如尸网络和恶意软件注入等更严重威胁的先驱.
- 对于资源有限的物联网环境,现有的安全措施可能不足.
研究的目的:
- 引入一种基于机器学习的新型检测系统,用于针对物联网设备的侦察攻击.
- 开发一种可解释的组合模型,能够识别早期的攻击活动.
- 设计一个适合资源有限的物联网生态系统的轻量级和高效系统.
主要方法:
- 开发一个可解释的整体机器学习模型.
- 实施一个专注于检测扫描和侦察活动的系统.
- 在准确性,假阳性和假阴性率方面测试系统的性能.
主要成果:
- 拟议的系统实现了99%的高准确率.
- 显示异常低的虚假阳性率 (0.6%) 和虚假阴性率 (0.05%).
- 该系统被证明是低资源消耗的高效,适合于受限制的环境.
结论:
- 开发的机器学习系统有效地检测物联网设备的侦察攻击.
- 该系统的可解释性和效率使其成为早期物联网威胁缓解的宝贵工具.
- 这种方法为增强快速增长的物联网生态系统的安全提供了有希望的解决方案.
相关概念视频
Classification of Systems-I
222
Linearity is a system property characterized by a direct input-output relationship, combining homogeneity and additivity.
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
222
Classification of Systems-II
183
Continuous-time systems have continuous input and output signals, with time measured continuously. These systems are generally defined by differential or algebraic equations. For instance, in an RC circuit, the relationship between input and output voltage is expressed through a differential equation derived from Ohm's law and the capacitor relation,
183
Force Classification
1.3K
Forces play a crucial role in the study of physics and engineering. They are essential in describing the motion, behavior, and equilibrium of objects in the physical world. Forces can be classified based on their origin, type, and direction of action.
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
1.3K
Masking and Demasking Agents
2.5K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
2.5K
Observational Learning
225
Albert Bandura's observational learning, also known as imitation or modeling, occurs when a person observes and imitates another's behavior. It is a quicker process than operant conditioning. A well-known example is the Bobo doll study, where children who saw an adult acting aggressively towards the doll were more likely to act aggressively when left alone, compared to those who observed a nonaggressive adult. Many psychologists view observational learning as a form of latent learning...
225


