首页 > 最新文献

2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)最新文献

英文 中文
Potential cyber-attacks against global oil supply chain 针对全球石油供应链的潜在网络攻击
M. Nasir, Shizra Sultan, S. Nefti-Meziani, U. Manzoor
The energy sector has been actively looking into cyber risk assessment at a global level, as it has a ripple effect; risk taken at one step in supply chain has an impact on all the other nodes. Cyber-attacks not only hinder functional operations in an organization but also waves damaging effects to the reputation and confidence among shareholders resulting in financial losses. Organizations that are open to the idea of protecting their assets and information flow and are equipped; enough to respond quickly to any cyber incident are the ones who prevail longer in global market. As a contribution we put forward a modular plan to mitigate or reduce cyber risks in global supply chain by identifying potential cyber threats at each step and identifying their immediate counterm easures.
能源行业一直在积极研究全球范围内的网络风险评估,因为它具有连锁反应;供应链中某一步的风险会影响到所有其他节点。网络攻击不仅会阻碍组织的功能运作,还会对股东的声誉和信心造成破坏性影响,从而导致财务损失。对保护其资产和信息流的想法持开放态度的组织,并配备了相应的设备;在全球市场上,能够对任何网络事件做出快速反应的人才更有优势。作为一项贡献,我们提出了一个模块化计划,通过识别每个步骤的潜在网络威胁并确定其即时应对措施,减轻或减少全球供应链中的网络风险。
{"title":"Potential cyber-attacks against global oil supply chain","authors":"M. Nasir, Shizra Sultan, S. Nefti-Meziani, U. Manzoor","doi":"10.1109/CYBERSA.2015.7166137","DOIUrl":"https://doi.org/10.1109/CYBERSA.2015.7166137","url":null,"abstract":"The energy sector has been actively looking into cyber risk assessment at a global level, as it has a ripple effect; risk taken at one step in supply chain has an impact on all the other nodes. Cyber-attacks not only hinder functional operations in an organization but also waves damaging effects to the reputation and confidence among shareholders resulting in financial losses. Organizations that are open to the idea of protecting their assets and information flow and are equipped; enough to respond quickly to any cyber incident are the ones who prevail longer in global market. As a contribution we put forward a modular plan to mitigate or reduce cyber risks in global supply chain by identifying potential cyber threats at each step and identifying their immediate counterm easures.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131572270","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Empirical framework for situation awareness measurement techniques in network defense 网络防御中态势感知测量技术的经验框架
Maria Evangelopoulou, C. W. Johnson
This paper presents an empirical framework for implementing Situation Awareness Measurement Techniques in a Network Defense environment. Bearing in mind the rise of Cyber-crime and the importance of Cyber security, the role of the security analyst (or as this paper will refer to them, defenders) is critical. In this paper the role of Situation Awareness Measurement Techniques will be presented and explained briefly. Input from previous studies will be given and an empirical framework of how to measure Situation Awareness in a computing network environment will be offered in two main parts. The first one will include the networking infrastructure of the system. The second part will be focused on specifying which Situation Awareness Techniques are going to be used and which Situation Awareness critical questions need to be asked to improve future decision making in cyber-security. Finally, a discussion will take place concerning the proposed approach, the chosen methodology and further validation.
本文提出了一个在网络防御环境中实施态势感知测量技术的经验框架。考虑到网络犯罪的兴起和网络安全的重要性,安全分析师(或本文所称的防御者)的角色至关重要。本文将简要介绍和解释态势感知测量技术的作用。本文将从之前的研究中得到输入,并将从两个主要部分提供如何在计算网络环境中测量态势感知的经验框架。第一个将包括系统的网络基础结构。第二部分将重点说明将使用哪些态势感知技术,以及需要提出哪些态势感知关键问题以改进未来网络安全决策。最后,将讨论所建议的方法、所选择的方法和进一步的验证。
{"title":"Empirical framework for situation awareness measurement techniques in network defense","authors":"Maria Evangelopoulou, C. W. Johnson","doi":"10.1109/CyberSA.2015.7166132","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166132","url":null,"abstract":"This paper presents an empirical framework for implementing Situation Awareness Measurement Techniques in a Network Defense environment. Bearing in mind the rise of Cyber-crime and the importance of Cyber security, the role of the security analyst (or as this paper will refer to them, defenders) is critical. In this paper the role of Situation Awareness Measurement Techniques will be presented and explained briefly. Input from previous studies will be given and an empirical framework of how to measure Situation Awareness in a computing network environment will be offered in two main parts. The first one will include the networking infrastructure of the system. The second part will be focused on specifying which Situation Awareness Techniques are going to be used and which Situation Awareness critical questions need to be asked to improve future decision making in cyber-security. Finally, a discussion will take place concerning the proposed approach, the chosen methodology and further validation.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"103 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134383818","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Cyber security: A game-theoretic analysis of defender and attacker strategies in defacing-website games 网络安全:毁损网站游戏中防御者和攻击者策略的博弈论分析
Palvi Aggarwal, Antra Grover, Saumya Singh, Zahid Maqbool, V. Pammi, Varun Dutt
The rate at which cyber-attacks are increasing globally portrays a terrifying picture upfront. The main dynamics of such attacks could be studied in terms of the actions of attackers and defenders in a cyber-security game. However currently little research has taken place to study such interactions. In this paper we use behavioral game theory and try to investigate the role of certain actions taken by attackers and defenders in a simulated cyber-attack scenario of defacing a website. We choose a Reinforcement Learning (RL) model to represent a simulated attacker and a defender in a 2×4 cyber-security game where each of the 2 players could take up to 4 actions. A pair of model participants were computationally simulated across 1000 simulations where each pair played at most 30 rounds in the game. The goal of the attacker was to deface the website and the goal of the defender was to prevent the attacker from doing so. Our results show that the actions taken by both the attackers and defenders are a function of attention paid by these roles to their recently obtained outcomes. It was observed that if attacker pays more attention to recent outcomes then he is more likely to perform attack actions. We discuss the implication of our results on the evolution of dynamics between attackers and defenders in cyber-security games.
全球范围内网络攻击的增长速度预先描绘了一幅可怕的画面。这种攻击的主要动力可以根据网络安全游戏中攻击者和防御者的行动来研究。然而,目前很少有研究对这种相互作用进行研究。在本文中,我们使用行为博弈论,并试图调查攻击者和防御者在破坏网站的模拟网络攻击场景中所采取的某些行动的作用。我们选择强化学习(RL)模型来代表2×4网络安全游戏中的模拟攻击者和防御者,其中两个玩家中的每个人最多可以采取4个行动。在1000次模拟中,对一对模型参与者进行了计算模拟,每对参与者最多玩了30轮游戏。攻击者的目标是破坏网站,防御者的目标是阻止攻击者这样做。我们的研究结果表明,攻击者和防御者所采取的行动是这些角色对他们最近获得的结果的关注的函数。据观察,如果攻击者更关注最近的结果,那么他更有可能执行攻击行动。我们讨论了我们的结果对网络安全博弈中攻击者和防御者之间动态演变的影响。
{"title":"Cyber security: A game-theoretic analysis of defender and attacker strategies in defacing-website games","authors":"Palvi Aggarwal, Antra Grover, Saumya Singh, Zahid Maqbool, V. Pammi, Varun Dutt","doi":"10.1109/CyberSA.2015.7166127","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166127","url":null,"abstract":"The rate at which cyber-attacks are increasing globally portrays a terrifying picture upfront. The main dynamics of such attacks could be studied in terms of the actions of attackers and defenders in a cyber-security game. However currently little research has taken place to study such interactions. In this paper we use behavioral game theory and try to investigate the role of certain actions taken by attackers and defenders in a simulated cyber-attack scenario of defacing a website. We choose a Reinforcement Learning (RL) model to represent a simulated attacker and a defender in a 2×4 cyber-security game where each of the 2 players could take up to 4 actions. A pair of model participants were computationally simulated across 1000 simulations where each pair played at most 30 rounds in the game. The goal of the attacker was to deface the website and the goal of the defender was to prevent the attacker from doing so. Our results show that the actions taken by both the attackers and defenders are a function of attention paid by these roles to their recently obtained outcomes. It was observed that if attacker pays more attention to recent outcomes then he is more likely to perform attack actions. We discuss the implication of our results on the evolution of dynamics between attackers and defenders in cyber-security games.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"102 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122198673","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Cross-domain situational awareness and collaborative working for cyber security 跨域态势感知和网络安全协同工作
M. Hall, Devon David Hansen, K. Jones
Enhancing situational awareness is a major goal for organisations spanning many sectors, working across many domains. An increased awareness of the state of environments enables improved decision-making. Endsley's model of situational awareness has improved the understanding for the design of decision-support systems. This paper presents and discusses a theoretical model to extend this to cross-domain working to influence the design of future collaborative systems. A use-case is discussed within a military context of the use of this model for cross-domain working between an operational-domain and cyber security-domain.
增强态势感知能力是跨多个部门、跨多个领域工作的组织的主要目标。提高对环境状况的认识可以改进决策。Endsley的态势感知模型提高了对决策支持系统设计的理解。本文提出并讨论了一个理论模型,将其扩展到跨领域工作,以影响未来协作系统的设计。在军事上下文中讨论了使用该模型在操作域和网络安全域之间进行跨域工作的用例。
{"title":"Cross-domain situational awareness and collaborative working for cyber security","authors":"M. Hall, Devon David Hansen, K. Jones","doi":"10.1109/CyberSA.2015.7166110","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166110","url":null,"abstract":"Enhancing situational awareness is a major goal for organisations spanning many sectors, working across many domains. An increased awareness of the state of environments enables improved decision-making. Endsley's model of situational awareness has improved the understanding for the design of decision-support systems. This paper presents and discusses a theoretical model to extend this to cross-domain working to influence the design of future collaborative systems. A use-case is discussed within a military context of the use of this model for cross-domain working between an operational-domain and cyber security-domain.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"105 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117187884","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
An SQL-like query tool for data anonymization and outsourcing 一个类似sql的查询工具,用于数据匿名化和外包
M. Nassar, A. A. Orabi, Marwan Doha, Bechara al Bouna
Data anonymization is an important preprocessing step for data sharing and the delegation of data storage to the cloud. In this paper, we propose an SQL-like query language and a tool to help the data provider ensuring the quality and the privacy of the data being outsourced. The tool supports a set of recent and well-known anonymization techniques in an SQL query style. We present our framework and the language capabilities. We report on experimental evaluation and results.
数据匿名化是数据共享和将数据存储委托给云的重要预处理步骤。在本文中,我们提出了一种类似sql的查询语言和工具,以帮助数据提供者确保被外包数据的质量和隐私。该工具支持一组最新的知名的SQL查询样式的匿名化技术。我们展示了我们的框架和语言功能。我们报告了实验评价和结果。
{"title":"An SQL-like query tool for data anonymization and outsourcing","authors":"M. Nassar, A. A. Orabi, Marwan Doha, Bechara al Bouna","doi":"10.1109/CyberSA.2015.7166130","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166130","url":null,"abstract":"Data anonymization is an important preprocessing step for data sharing and the delegation of data storage to the cloud. In this paper, we propose an SQL-like query language and a tool to help the data provider ensuring the quality and the privacy of the data being outsourced. The tool supports a set of recent and well-known anonymization techniques in an SQL query style. We present our framework and the language capabilities. We report on experimental evaluation and results.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116942236","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Security management in Wireless Sensor Networks 无线传感器网络中的安全管理
S. Neogy
This paper aims to describe the characteristics of Wireless Sensor Networks (WSNs), challenges in designing a resource-constrained and vulnerable network and address security management as the main issue. The work begins with discussion on the attacks on WSNs. As part of protection against the attacks faced by WSNs, key management, the primary requirement of any security practice, is detailed out. This paper also deals with the existing security schemes covering various routing protocols. The paper also touches security issues concerning heterogeneous networks.
本文旨在描述无线传感器网络(WSNs)的特点,设计资源受限和脆弱的网络所面临的挑战,并将安全管理作为主要问题。这项工作首先讨论了对无线传感器网络的攻击。作为防止无线传感器网络所面临的攻击的一部分,详细介绍了任何安全实践的基本要求——密钥管理。本文还讨论了涵盖各种路由协议的现有安全方案。本文还讨论了异构网络的安全问题。
{"title":"Security management in Wireless Sensor Networks","authors":"S. Neogy","doi":"10.1109/CyberSA.2015.7166112","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166112","url":null,"abstract":"This paper aims to describe the characteristics of Wireless Sensor Networks (WSNs), challenges in designing a resource-constrained and vulnerable network and address security management as the main issue. The work begins with discussion on the attacks on WSNs. As part of protection against the attacks faced by WSNs, key management, the primary requirement of any security practice, is detailed out. This paper also deals with the existing security schemes covering various routing protocols. The paper also touches security issues concerning heterogeneous networks.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124012037","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Developing a secure remote patient monitoring system 开发安全的远程患者监护系统
S. Neogy, Sayantani Saha
Cloud computing offers and allows users to use infrastructure, platforms, and software as services. With the advent of mobile computing, and cloud computing supporting mobile services, a merger of both these computing has opened a new domain of mobile cloud computing. Predictably, this has given way to a large number of issues coming forward, first and foremost among them, being, security. This paper develops a protocol suite that takes care of an entire mobile cloud computing (MCC) system with respect to a specific application area. Patient monitoring and providing subsequent medical care in remote areas is a problem. The proposal presented here considers the application of remote patient monitoring. The protocol considers remote user authentication and subsequently develop secure access to data retained using cloud infrastructure. A cloud service provider is considered that manages users and their requests.
云计算提供并允许用户将基础设施、平台和软件作为服务使用。随着移动计算和支持移动服务的云计算的出现,这两种计算的合并开辟了移动云计算的新领域。可以预见的是,这已经让位于出现的大量问题,其中首先是安全问题。本文开发了一个协议套件,可以针对特定的应用领域来处理整个移动云计算(MCC)系统。在偏远地区对病人进行监测和提供后续医疗护理是一个问题。这里提出的建议考虑了远程病人监护的应用。该协议考虑远程用户身份验证,并随后开发对使用云基础设施保留的数据的安全访问。云服务提供商负责管理用户及其请求。
{"title":"Developing a secure remote patient monitoring system","authors":"S. Neogy, Sayantani Saha","doi":"10.1109/CyberSA.2015.7166123","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166123","url":null,"abstract":"Cloud computing offers and allows users to use infrastructure, platforms, and software as services. With the advent of mobile computing, and cloud computing supporting mobile services, a merger of both these computing has opened a new domain of mobile cloud computing. Predictably, this has given way to a large number of issues coming forward, first and foremost among them, being, security. This paper develops a protocol suite that takes care of an entire mobile cloud computing (MCC) system with respect to a specific application area. Patient monitoring and providing subsequent medical care in remote areas is a problem. The proposal presented here considers the application of remote patient monitoring. The protocol considers remote user authentication and subsequently develop secure access to data retained using cloud infrastructure. A cloud service provider is considered that manages users and their requests.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132452339","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Risk analysis in cyber situation awareness using Bayesian approach 基于贝叶斯方法的网络态势感知风险分析
Moyinoluwa Abidemi Bode, S. Oluwadare, B. K. Alese, A. Thompson
The unpredictable cyber attackers and threats have to be detected in order to determine the outcome of risk in a network environment. This work develops a Bayesian network classifier to analyse the network traffic in a cyber situation. It is a tool that aids reasoning under uncertainty to determine certainty. It further analyze the level of risk using a modified risk matrix criteria. The classifier developed was experimented with various records extracted from the KDD Cup'99 dataset with 490,021 records. The evaluations showed that the Bayesian Network classifier is a suitable model which resulted in same performance level for classifying the Denial of Service (DoS) attacks with Association Rule Mining while as well as Genetic Algorithm, the Bayesian Network classifier performed better in classifying probe and User to Root (U2R) attacks and classified DoS equally. The result of the classification showed that Bayesian network classifier is a classification model that thrives well in network security. Also, the level of risk analysed from the adapted risk matrix showed that DoS attack has the most frequent occurrence and falls in the generally unacceptable risk zone.
为了确定网络环境中风险的结果,必须检测不可预测的网络攻击者和威胁。这项工作开发了一个贝叶斯网络分类器来分析网络情况下的网络流量。它是在不确定的情况下帮助推理确定确定性的工具。它进一步分析了使用改进的风险矩阵标准的风险水平。开发的分类器对从KDD Cup'99数据集中提取的490,021条记录进行了实验。实验结果表明,贝叶斯网络分类器与关联规则挖掘在分类拒绝服务攻击(DoS)时具有相同的性能水平,而与遗传算法相比,贝叶斯网络分类器对探测攻击和用户到根攻击(U2R)的分类效果更好,对DoS的分类效果相同。分类结果表明,贝叶斯网络分类器是一种在网络安全领域发展良好的分类模型。此外,从适应风险矩阵分析的风险水平表明,DoS攻击发生最频繁,落在一般不可接受的风险区域。
{"title":"Risk analysis in cyber situation awareness using Bayesian approach","authors":"Moyinoluwa Abidemi Bode, S. Oluwadare, B. K. Alese, A. Thompson","doi":"10.1109/CyberSA.2015.7166119","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166119","url":null,"abstract":"The unpredictable cyber attackers and threats have to be detected in order to determine the outcome of risk in a network environment. This work develops a Bayesian network classifier to analyse the network traffic in a cyber situation. It is a tool that aids reasoning under uncertainty to determine certainty. It further analyze the level of risk using a modified risk matrix criteria. The classifier developed was experimented with various records extracted from the KDD Cup'99 dataset with 490,021 records. The evaluations showed that the Bayesian Network classifier is a suitable model which resulted in same performance level for classifying the Denial of Service (DoS) attacks with Association Rule Mining while as well as Genetic Algorithm, the Bayesian Network classifier performed better in classifying probe and User to Root (U2R) attacks and classified DoS equally. The result of the classification showed that Bayesian network classifier is a classification model that thrives well in network security. Also, the level of risk analysed from the adapted risk matrix showed that DoS attack has the most frequent occurrence and falls in the generally unacceptable risk zone.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133763615","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
An immune intelligent approach for security assurance 安全保障的免疫智能方法
A. Enache, Mihai-Gabriel Ionita, V. Sgârciu
Information Security Assurance implies ensuring the integrity, confidentiality and availability of critical assets for an organization. The large amount of events to monitor in a fluid system in terms of topology and variety of new hardware or software, overwhelms monitoring controls. Furthermore, the multi-facets of cyber threats today makes it difficult even for security experts to handle and keep up-to-date. Hence, automatic "intelligent" tools are needed to address these issues. In this paper, we describe a `work in progress' contribution on intelligent based approach to mitigating security threats. The main contribution of this work is an anomaly based IDS model with active response that combines artificial immune systems and swarm intelligence with the SVM classifier. Test results for the NSL-KDD dataset prove the proposed approach can outperform the standard classifier in terms of attack detection rate and false alarm rate, while reducing the number of features in the dataset.
信息安全保证意味着确保组织关键资产的完整性、机密性和可用性。流体系统中需要监控的大量事件(拓扑结构和各种新硬件或软件)压倒了监控控制。此外,当今网络威胁的多面性甚至使安全专家也难以处理和保持最新。因此,需要自动的“智能”工具来解决这些问题。在本文中,我们描述了“正在进行的工作”对基于智能的方法来减轻安全威胁的贡献。本工作的主要贡献是将人工免疫系统和群体智能与SVM分类器相结合,建立了一种基于异常的主动响应IDS模型。对NSL-KDD数据集的测试结果证明,该方法在攻击检测率和虚警率方面优于标准分类器,同时减少了数据集中的特征数量。
{"title":"An immune intelligent approach for security assurance","authors":"A. Enache, Mihai-Gabriel Ionita, V. Sgârciu","doi":"10.1109/CyberSA.2015.7166116","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166116","url":null,"abstract":"Information Security Assurance implies ensuring the integrity, confidentiality and availability of critical assets for an organization. The large amount of events to monitor in a fluid system in terms of topology and variety of new hardware or software, overwhelms monitoring controls. Furthermore, the multi-facets of cyber threats today makes it difficult even for security experts to handle and keep up-to-date. Hence, automatic \"intelligent\" tools are needed to address these issues. In this paper, we describe a `work in progress' contribution on intelligent based approach to mitigating security threats. The main contribution of this work is an anomaly based IDS model with active response that combines artificial immune systems and swarm intelligence with the SVM classifier. Test results for the NSL-KDD dataset prove the proposed approach can outperform the standard classifier in terms of attack detection rate and false alarm rate, while reducing the number of features in the dataset.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-06-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132819764","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Analysis of malware behavior: Type classification using machine learning 恶意软件行为分析:使用机器学习进行类型分类
Radu S. Pirscoveanu, Steven S. Hansen, Thor M. T. Larsen, Matija Stevanovic, J. Pedersen, A. Czech
Malicious software has become a major threat to modern society, not only due to the increased complexity of the malware itself but also due to the exponential increase of new malware each day. This study tackles the problem of analyzing and classifying a high amount of malware in a scalable and automatized manner. We have developed a distributed malware testing environment by extending Cuckoo Sandbox that was used to test an extensive number of malware samples and trace their behavioral data. The extracted data was used for the development of a novel type classification approach based on supervised machine learning. The proposed classification approach employs a novel combination of features that achieves a high classification rate with a weighted average AUC value of 0.98 using Random Forests classifier. The approach has been extensively tested on a total of 42,000 malware samples. Based on the above results it is believed that the developed system can be used to pre-filter novel from known malware in a future malware analysis system.
恶意软件已经成为现代社会的主要威胁,不仅是因为恶意软件本身的复杂性增加,而且还因为每天都有新的恶意软件呈指数级增长。本研究解决了以可扩展和自动化的方式对大量恶意软件进行分析和分类的问题。我们通过扩展Cuckoo Sandbox开发了一个分布式恶意软件测试环境,用于测试大量恶意软件样本并跟踪其行为数据。提取的数据用于开发一种基于监督机器学习的新型类型分类方法。本文提出的分类方法采用了一种新颖的特征组合,使用随机森林分类器实现了较高的分类率,加权平均AUC值为0.98。该方法已经在总共42000个恶意软件样本上进行了广泛的测试。基于以上结果,认为所开发的系统可以在未来的恶意软件分析系统中用于从已知恶意软件中预过滤新的恶意软件。
{"title":"Analysis of malware behavior: Type classification using machine learning","authors":"Radu S. Pirscoveanu, Steven S. Hansen, Thor M. T. Larsen, Matija Stevanovic, J. Pedersen, A. Czech","doi":"10.1109/CyberSA.2015.7166128","DOIUrl":"https://doi.org/10.1109/CyberSA.2015.7166128","url":null,"abstract":"Malicious software has become a major threat to modern society, not only due to the increased complexity of the malware itself but also due to the exponential increase of new malware each day. This study tackles the problem of analyzing and classifying a high amount of malware in a scalable and automatized manner. We have developed a distributed malware testing environment by extending Cuckoo Sandbox that was used to test an extensive number of malware samples and trace their behavioral data. The extracted data was used for the development of a novel type classification approach based on supervised machine learning. The proposed classification approach employs a novel combination of features that achieves a high classification rate with a weighted average AUC value of 0.98 using Random Forests classifier. The approach has been extensively tested on a total of 42,000 malware samples. Based on the above results it is believed that the developed system can be used to pre-filter novel from known malware in a future malware analysis system.","PeriodicalId":432356,"journal":{"name":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","volume":"47 8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125718997","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1