College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China.
The Collaborative Innovation Center of Novel Software Technology and Industrialization, Nanjing 210023, China.
Sensors (Basel). 2019 Sep 19;19(18):4045. doi: 10.3390/s19184045.
With the emergence of the Advanced Persistent Threat (APT) attacks, many Internet of Things (IoT) systems have faced large numbers of potential threats with the characteristics of concealment, permeability, and pertinence. However, existing methods and technologies cannot provide comprehensive and prompt recognition of latent APT attack activities in the IoT systems. To address this problem, we propose an APT Alerts and Logs Correlation Method, named APTALCM and a framework of deploying APTALCM on the IoT system, where an edge computing architecture was used to achieve cyber situation comprehension without too much data transmission cost. Specifically, we firstly present a cyber situation ontology for modeling the concepts and properties to formalize APT attack activities in the IoT systems. Then, we introduce a cyber situation instance similarity measurement method based on the SimRank mechanism for APT alerts and logs Correlation. Combining with instance similarity, we further propose an APT alert instances correlation method to reconstruct APT attack scenarios and an APT log instances correlation method to detect log instance communities. Through the coalescence of these methods, APTALCM can accomplish the cyber situation comprehension effectively by recognizing the APT attack intentions in the IoT systems. The exhaustive experimental results demonstrate that the two kernel modules, i.e., Alert Instance Correlation Module (AICM) and Log Instance Correlation Module (LICM) in our APTALCM, can achieve both high true-positive rate and low false-positive rate.
随着高级持续性威胁 (APT) 攻击的出现，许多物联网 (IoT) 系统面临着大量潜在威胁，这些威胁具有隐蔽性、渗透性和针对性的特点。然而，现有的方法和技术无法在物联网系统中全面、及时地识别潜在的 APT 攻击活动。为了解决这个问题，我们提出了一种 APT 警报和日志关联方法，命名为 APTALCM，并提出了在物联网系统上部署 APTALCM 的框架，其中使用边缘计算架构来实现网络态势感知，而不会产生太多的数据传输成本。具体来说，我们首先提出了一个网络态势本体，用于对物联网系统中的概念和属性进行建模，以形式化 APT 攻击活动。然后，我们引入了一种基于 SimRank 机制的网络态势实例相似性度量方法，用于 APT 警报和日志的关联。结合实例相似性，我们进一步提出了一种 APT 警报实例关联方法来重构 APT 攻击场景，以及一种 APT 日志实例关联方法来检测日志实例社区。通过这些方法的融合，APTALCM 可以通过识别物联网系统中的 APT 攻击意图，有效地实现网络态势感知。详尽的实验结果表明，我们的 APTALCM 中的两个核心模块，即警报实例关联模块 (AICM) 和日志实例关联模块 (LICM)，可以实现高真阳性率和低假阳性率。
